about summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--.git-blame-ignore-revs2
-rw-r--r--maintainers/maintainer-list.nix12
-rw-r--r--maintainers/team-list.nix10
-rw-r--r--nixos/doc/manual/release-notes/rl-2405.section.md2
-rw-r--r--nixos/modules/module-list.nix1
-rw-r--r--nixos/modules/services/misc/private-gpt.nix121
-rw-r--r--nixos/modules/services/x11/desktop-managers/mate.nix1
-rw-r--r--nixos/tests/all-tests.nix1
-rw-r--r--nixos/tests/misc.nix340
-rw-r--r--nixos/tests/private-gpt.nix27
-rw-r--r--pkgs/applications/audio/feishin/default.nix8
-rw-r--r--pkgs/applications/editors/vim/plugins/generated.nix12
-rw-r--r--pkgs/applications/editors/vim/plugins/vim-plugin-names1
-rw-r--r--pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix4
-rw-r--r--pkgs/applications/emulators/retroarch/hashes.json54
-rw-r--r--pkgs/applications/finance/irpf/default.nix6
-rw-r--r--pkgs/applications/misc/waypaper/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/cilium/default.nix4
-rw-r--r--pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix6
-rw-r--r--pkgs/applications/networking/mailreaders/thunderbird/packages.nix45
-rw-r--r--pkgs/applications/networking/weather/meteo/default.nix2
-rw-r--r--pkgs/applications/video/mpv/scripts/evafast.nix3
-rw-r--r--pkgs/by-name/ca/catppuccin-sddm/package.nix80
-rw-r--r--pkgs/by-name/cr/crunchy-cli/Cargo.lock235
-rw-r--r--pkgs/by-name/cr/crunchy-cli/package.nix4
-rw-r--r--pkgs/by-name/fi/files-cli/package.nix6
-rw-r--r--pkgs/by-name/fo/forbidden/package.nix10
-rw-r--r--pkgs/by-name/pr/private-gpt/package.nix17
-rw-r--r--pkgs/by-name/sa/sarif-tools/package.nix4
-rw-r--r--pkgs/by-name/ti/tinymist/Cargo.lock100
-rw-r--r--pkgs/by-name/ti/tinymist/package.nix6
-rw-r--r--pkgs/by-name/to/tootik/package.nix6
-rw-r--r--pkgs/by-name/tr/troubadix/package.nix4
-rw-r--r--pkgs/data/fonts/iosevka/default.nix6
-rw-r--r--pkgs/data/icons/kora-icon-theme/default.nix4
-rw-r--r--pkgs/development/libraries/vte/default.nix3
-rw-r--r--pkgs/development/misc/brev-cli/default.nix4
-rw-r--r--pkgs/development/python-modules/adext/default.nix39
-rw-r--r--pkgs/development/python-modules/apprise/default.nix49
-rw-r--r--pkgs/development/python-modules/btrfs/default.nix4
-rw-r--r--pkgs/development/python-modules/cloudflare/default.nix4
-rw-r--r--pkgs/development/python-modules/courlan/default.nix56
-rw-r--r--pkgs/development/python-modules/dropbox/default.nix12
-rw-r--r--pkgs/development/python-modules/hawkauthlib/default.nix37
-rw-r--r--pkgs/development/python-modules/html-text/default.nix40
-rw-r--r--pkgs/development/python-modules/htseq/default.nix72
-rw-r--r--pkgs/development/python-modules/ical/default.nix4
-rw-r--r--pkgs/development/python-modules/pipdeptree/default.nix4
-rw-r--r--pkgs/development/python-modules/private-gpt/default.nix119
-rw-r--r--pkgs/development/python-modules/pybrowserid/default.nix34
-rw-r--r--pkgs/development/python-modules/pyfxa/default.nix8
-rw-r--r--pkgs/development/python-modules/pyinsteon/default.nix48
-rw-r--r--pkgs/development/python-modules/pynmeagps/default.nix6
-rw-r--r--pkgs/development/python-modules/python-roborock/default.nix4
-rw-r--r--pkgs/development/python-modules/sacn/default.nix4
-rw-r--r--pkgs/development/python-modules/sarif-tools/default.nix69
-rw-r--r--pkgs/development/python-modules/trafilatura/default.nix72
-rw-r--r--pkgs/development/tools/golangci-lint/default.nix6
-rw-r--r--pkgs/development/tools/misc/terramate/default.nix9
-rw-r--r--pkgs/development/tools/rust/cargo-binstall/default.nix6
-rw-r--r--pkgs/development/tools/yq-go/default.nix6
-rw-r--r--pkgs/servers/monitoring/prometheus/snmp-exporter.nix6
-rw-r--r--pkgs/servers/web-apps/netbox/default.nix4
-rw-r--r--pkgs/servers/x11/xorg/xwayland.nix12
-rw-r--r--pkgs/tools/admin/google-cloud-sdk/default.nix2
-rw-r--r--pkgs/tools/misc/octosql/default.nix4
-rw-r--r--pkgs/tools/misc/pre-commit/default.nix4
-rw-r--r--pkgs/tools/networking/shadowsocks-rust/default.nix6
-rw-r--r--pkgs/tools/package-management/lix/common.nix286
-rw-r--r--pkgs/tools/package-management/lix/default.nix60
-rw-r--r--pkgs/tools/package-management/lix/doc/default.nix12
-rw-r--r--pkgs/top-level/all-packages.nix10
-rw-r--r--pkgs/top-level/python-packages.nix4
73 files changed, 1638 insertions, 639 deletions
diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index 74e4fa9ba4eb2..c0a31e826ac04 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -113,4 +113,4 @@ fb0e5be84331188a69b3edd31679ca6576edb75a
 3fe3b055adfc020e6a923c466b6bcd978a13069a
 
 # k3s: format with nixfmt-rfc-style
-0b7900d5e8e0bcac89e14a52d3e840f9201e9f47
+6cfcd3c75428ede517bc6b15a353d704837a2830
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index edb4f243cc102..ca0857fe48b18 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5919,6 +5919,12 @@
     githubId = 1365692;
     name = "Will Fancher";
   };
+  elysasrc = {
+    name = "Elysa";
+    github = "ElysaSrc";
+    githubId = 101974839;
+    email = "elysasrc@proton.me";
+  };
   emantor = {
     email = "rouven+nixos@czerwinskis.de";
     github = "Emantor";
@@ -8592,6 +8598,12 @@
     githubId = 3948275;
     name = "Harikrishnan R";
   };
+  ilya-epifanov = {
+    email = "mail@ilya.network";
+    github = "ilya-epifanov";
+    githubId = 92526;
+    name = "Ilya";
+  };
   ilya-fedin = {
     email = "fedin-ilja2010@ya.ru";
     github = "ilya-fedin";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 2a50f6f98d095..8b609bce4f269 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -723,6 +723,16 @@ with lib.maintainers; {
     enableFeatureFreezePing = true;
   };
 
+  lix = {
+    members = [
+      raitobezarius
+      qyriad
+    ];
+    scope = "Maintain the Lix package manager inside of Nixpkgs.";
+    shortName = "Lix ecosystem";
+    enableFeatureFreezePing = true;
+  };
+
   module-system = {
     members = [
       infinisil
diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md
index 351a49f18119c..be087d2e88723 100644
--- a/nixos/doc/manual/release-notes/rl-2405.section.md
+++ b/nixos/doc/manual/release-notes/rl-2405.section.md
@@ -209,6 +209,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).
 
+- [private-gpt](https://github.com/zylon-ai/private-gpt), a service to interact with your documents using the power of LLMs, 100% privately, no data leaks. Available as [services.private-gpt](#opt-services.private-gpt.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 76ccf5a341094..3cbb4617517aa 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -776,6 +776,7 @@
   ./services/misc/polaris.nix
   ./services/misc/portunus.nix
   ./services/misc/preload.nix
+  ./services/misc/private-gpt.nix
   ./services/misc/prowlarr.nix
   ./services/misc/pufferpanel.nix
   ./services/misc/pykms.nix
diff --git a/nixos/modules/services/misc/private-gpt.nix b/nixos/modules/services/misc/private-gpt.nix
new file mode 100644
index 0000000000000..9a3e5317cdb14
--- /dev/null
+++ b/nixos/modules/services/misc/private-gpt.nix
@@ -0,0 +1,121 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  inherit (lib) types;
+
+  format = pkgs.formats.yaml { };
+  cfg = config.services.private-gpt;
+in
+{
+  options = {
+    services.private-gpt = {
+      enable = lib.mkEnableOption "private-gpt for local large language models";
+      package = lib.mkPackageOption pkgs "private-gpt" { };
+
+      stateDir = lib.mkOption {
+        type = types.path;
+        default = "/var/lib/private-gpt";
+        description = "State directory of private-gpt.";
+      };
+
+      settings = lib.mkOption {
+        type = format.type;
+        default = {
+          llm = {
+            mode = "ollama";
+            tokenizer = "";
+          };
+          embedding = {
+            mode = "ollama";
+          };
+          ollama = {
+            llm_model = "llama3";
+            embedding_model = "nomic-embed-text";
+            api_base = "http://localhost:11434";
+            embedding_api_base = "http://localhost:11434";
+            keep_alive = "5m";
+            tfs_z = 1;
+            top_k = 40;
+            top_p = 0.9;
+            repeat_last_n = 64;
+            repeat_penalty = 1.2;
+            request_timeout = 120;
+          };
+          vectorstore = {
+            database = "qdrant";
+          };
+          qdrant = {
+            path = "/var/lib/private-gpt/vectorstore/qdrant";
+          };
+          data = {
+            local_data_folder = "/var/lib/private-gpt";
+          };
+          openai = { };
+          azopenai = { };
+        };
+        description = ''
+          settings-local.yaml for private-gpt
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.private-gpt = {
+      description = "Interact with your documents using the power of GPT, 100% privately, no data leaks";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      preStart =
+        let
+          config = format.generate "settings-local.yaml" (cfg.settings // { server.env_name = "local"; });
+        in
+        ''
+          mkdir -p ${cfg.stateDir}/{settings,huggingface,matplotlib,tiktoken_cache}
+          cp ${cfg.package.cl100k_base.tiktoken} ${cfg.stateDir}/tiktoken_cache/9b5ad71b2ce5302211f9c61530b329a4922fc6a4
+          cp ${pkgs.python3Packages.private-gpt}/${pkgs.python3.sitePackages}/private_gpt/settings.yaml ${cfg.stateDir}/settings/settings.yaml
+          cp "${config}" "${cfg.stateDir}/settings/settings-local.yaml"
+          chmod 600 "${cfg.stateDir}/settings/settings-local.yaml"
+        '';
+
+      environment = {
+        PGPT_PROFILES = "local";
+        PGPT_SETTINGS_FOLDER = "${cfg.stateDir}/settings";
+        HF_HOME = "${cfg.stateDir}/huggingface";
+        TRANSFORMERS_OFFLINE = "1";
+        HF_DATASETS_OFFLINE = "1";
+        MPLCONFIGDIR = "${cfg.stateDir}/matplotlib";
+      };
+
+      serviceConfig = {
+        ExecStart = lib.getExe cfg.package;
+        WorkingDirectory = cfg.stateDir;
+        StateDirectory = "private-gpt";
+        RuntimeDirectory = "private-gpt";
+        RuntimeDirectoryMode = "0755";
+        PrivateTmp = true;
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ drupol ];
+}
diff --git a/nixos/modules/services/x11/desktop-managers/mate.nix b/nixos/modules/services/x11/desktop-managers/mate.nix
index beae07b70dbfe..19235be4aa8d5 100644
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@@ -84,6 +84,7 @@ in
       programs.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
 
       services.gnome.at-spi2-core.enable = true;
+      services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 9af07688c03cb..f9e81f2bbd8d6 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -757,6 +757,7 @@ in {
   pretix = runTest ./web-apps/pretix.nix;
   printing-socket = handleTest ./printing.nix { socket = true; };
   printing-service = handleTest ./printing.nix { socket = false; };
+  private-gpt = handleTest ./private-gpt.nix {};
   privoxy = handleTest ./privoxy.nix {};
   prometheus = handleTest ./prometheus.nix {};
   prometheus-exporters = handleTest ./prometheus-exporters.nix {};
diff --git a/nixos/tests/misc.nix b/nixos/tests/misc.nix
index e7842debba7a2..aa9b9fbe29a52 100644
--- a/nixos/tests/misc.nix
+++ b/nixos/tests/misc.nix
@@ -1,164 +1,182 @@
 # Miscellaneous small tests that don't warrant their own VM run.
-
-import ./make-test-python.nix ({ lib, pkgs, ...} : let
-  foo = pkgs.writeText "foo" "Hello World";
-in {
-  name = "misc";
-  meta.maintainers = with lib.maintainers; [ eelco ];
-
-  nodes.machine =
-    { lib, ... }:
-    { swapDevices = lib.mkOverride 0
-        [ { device = "/root/swapfile"; size = 128; } ];
-      environment.variables.EDITOR = lib.mkOverride 0 "emacs";
-      documentation.nixos.enable = lib.mkOverride 0 true;
-      systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
-      systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = {};
-      virtualisation.fileSystems = { "/tmp2" =
-        { fsType = "tmpfs";
-          options = [ "mode=1777" "noauto" ];
-        };
-        # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
-        "/user-mount/point" = {
-          device = "/user-mount/source";
-          fsType = "none";
-          options = [ "bind" "rw" "user" "noauto" ];
-        };
-        "/user-mount/denied-point" = {
-          device = "/user-mount/denied-source";
-          fsType = "none";
-          options = [ "bind" "rw" "noauto" ];
+{ pkgs, ... }:
+
+let
+  inherit (pkgs) lib;
+  tests = {
+    default = testsForPackage { nixPackage = pkgs.nix; };
+    lix = testsForPackage { nixPackage = pkgs.lix; };
+  };
+
+  testsForPackage = args: lib.recurseIntoAttrs {
+    miscFeatures = testMiscFeatures args;
+    passthru.override = args': testsForPackage (args // args');
+  };
+
+  testMiscFeatures = { nixPackage, ... }: pkgs.testers.nixosTest (
+  let
+    foo = pkgs.writeText "foo" "Hello World";
+  in {
+    name = "misc";
+    meta.maintainers = with lib.maintainers; [ raitobezarius ];
+
+    nodes.machine =
+      { lib, ... }:
+      { swapDevices = lib.mkOverride 0
+          [ { device = "/root/swapfile"; size = 128; } ];
+        environment.variables.EDITOR = lib.mkOverride 0 "emacs";
+        documentation.nixos.enable = lib.mkOverride 0 true;
+        systemd.tmpfiles.rules = [ "d /tmp 1777 root root 10d" ];
+        systemd.tmpfiles.settings."10-test"."/tmp/somefile".d = {};
+        virtualisation.fileSystems = { "/tmp2" =
+          { fsType = "tmpfs";
+            options = [ "mode=1777" "noauto" ];
+          };
+          # Tests https://discourse.nixos.org/t/how-to-make-a-derivations-executables-have-the-s-permission/8555
+          "/user-mount/point" = {
+            device = "/user-mount/source";
+            fsType = "none";
+            options = [ "bind" "rw" "user" "noauto" ];
+          };
+          "/user-mount/denied-point" = {
+            device = "/user-mount/denied-source";
+            fsType = "none";
+            options = [ "bind" "rw" "noauto" ];
+          };
         };
+        systemd.automounts = lib.singleton
+          { wantedBy = [ "multi-user.target" ];
+            where = "/tmp2";
+          };
+        users.users.sybil = { isNormalUser = true; group = "wheel"; };
+        users.users.alice = { isNormalUser = true; };
+        security.sudo = { enable = true; wheelNeedsPassword = false; };
+        boot.kernel.sysctl."vm.swappiness" = 1;
+        boot.kernelParams = [ "vsyscall=emulate" ];
+        system.extraDependencies = [ foo ];
+
+        nix.package = nixPackage;
       };
-      systemd.automounts = lib.singleton
-        { wantedBy = [ "multi-user.target" ];
-          where = "/tmp2";
-        };
-      users.users.sybil = { isNormalUser = true; group = "wheel"; };
-      users.users.alice = { isNormalUser = true; };
-      security.sudo = { enable = true; wheelNeedsPassword = false; };
-      boot.kernel.sysctl."vm.swappiness" = 1;
-      boot.kernelParams = [ "vsyscall=emulate" ];
-      system.extraDependencies = [ foo ];
-    };
-
-  testScript =
-    ''
-      import json
-
-
-      def get_path_info(path):
-          result = machine.succeed(f"nix --option experimental-features nix-command path-info --json {path}")
-          parsed = json.loads(result)
-          return parsed
-
-
-      with subtest("nix-db"):
-          info = get_path_info("${foo}")
-          print(info)
-
-          if (
-              info[0]["narHash"]
-              != "sha256-BdMdnb/0eWy3EddjE83rdgzWWpQjfWPAj3zDIFMD3Ck="
-          ):
-              raise Exception("narHash not set")
-
-          if info[0]["narSize"] != 128:
-              raise Exception("narSize not set")
-
-      with subtest("nixos-version"):
-          machine.succeed("[ `nixos-version | wc -w` = 2 ]")
-
-      with subtest("nixos-rebuild"):
-          assert "NixOS module" in machine.succeed("nixos-rebuild --help")
-
-      with subtest("Sanity check for uid/gid assignment"):
-          assert "4" == machine.succeed("id -u messagebus").strip()
-          assert "4" == machine.succeed("id -g messagebus").strip()
-          assert "users:x:100:" == machine.succeed("getent group users").strip()
-
-      with subtest("Regression test for GMP aborts on QEMU."):
-          machine.succeed("expr 1 + 2")
-
-      with subtest("the swap file got created"):
-          machine.wait_for_unit("root-swapfile.swap")
-          machine.succeed("ls -l /root/swapfile | grep 134217728")
-
-      with subtest("whether kernel.poweroff_cmd is set"):
-          machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
-
-      with subtest("whether the io cgroupv2 controller is properly enabled"):
-          machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
-
-      with subtest("whether we have a reboot record in wtmp"):
-          machine.shutdown
-          machine.wait_for_unit("multi-user.target")
-          machine.succeed("last | grep reboot >&2")
-
-      with subtest("whether we can override environment variables"):
-          machine.succeed('[ "$EDITOR" = emacs ]')
-
-      with subtest("whether hostname (and by extension nss_myhostname) works"):
-          assert "machine" == machine.succeed("hostname").strip()
-          assert "machine" == machine.succeed("hostname -s").strip()
-
-      with subtest("whether systemd-udevd automatically loads modules for our hardware"):
-          machine.succeed("systemctl start systemd-udev-settle.service")
-          machine.wait_for_unit("systemd-udev-settle.service")
-          assert "mousedev" in machine.succeed("lsmod")
-
-      with subtest("whether systemd-tmpfiles-clean works"):
-          machine.succeed(
-              "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
-          )
-          # move into the future
-          machine.succeed(
-              'date -s "@$(($(date +%s) + 1000000))"',
-              "systemctl start systemd-tmpfiles-clean",
-          )
-          machine.fail("[ -e /tmp/foo ]")
-
-      with subtest("whether systemd-tmpfiles settings works"):
-          machine.succeed("[ -e /tmp/somefile ]")
-
-      with subtest("whether automounting works"):
-          machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
-          machine.succeed("touch /tmp2/x")
-          machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
-
-      with subtest(
-          "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
-      ):
-          machine.succeed("mkdir -p /user-mount/source")
-          machine.succeed("touch /user-mount/source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/source")
-          machine.succeed("mkdir /user-mount/point")
-          machine.succeed("chown alice:users /user-mount/point")
-          machine.succeed("su - alice -c 'mount /user-mount/point'")
-          machine.succeed("su - alice -c 'ls /user-mount/point/file'")
-      with subtest(
-          "Whether mounting by a user is denied without the `user` option in  fstab"
-      ):
-          machine.succeed("mkdir -p /user-mount/denied-source")
-          machine.succeed("touch /user-mount/denied-source/file")
-          machine.succeed("chmod -R a+Xr /user-mount/denied-source")
-          machine.succeed("mkdir /user-mount/denied-point")
-          machine.succeed("chown alice:users /user-mount/denied-point")
-          machine.fail("su - alice -c 'mount /user-mount/denied-point'")
-
-      with subtest("shell-vars"):
-          machine.succeed('[ -n "$NIX_PATH" ]')
-
-      with subtest("nix-db"):
-          machine.succeed("nix-store -qR /run/current-system | grep nixos-")
-
-      with subtest("Test sysctl"):
-          machine.wait_for_unit("systemd-sysctl.service")
-          assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
-          machine.execute("sysctl vm.swappiness=60")
-          assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
-
-      with subtest("Test boot parameters"):
-          assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
-    '';
-})
+
+    testScript =
+      ''
+        import json
+
+
+        def get_path_info(path):
+            result = machine.succeed(f"nix --option experimental-features nix-command path-info --json {path}")
+            parsed = json.loads(result)
+            return parsed
+
+
+        with subtest("nix-db"):
+            info = get_path_info("${foo}")
+            print(info)
+
+            if (
+                info[0]["narHash"]
+                != "sha256-BdMdnb/0eWy3EddjE83rdgzWWpQjfWPAj3zDIFMD3Ck="
+            ):
+                raise Exception("narHash not set")
+
+            if info[0]["narSize"] != 128:
+                raise Exception("narSize not set")
+
+        with subtest("nixos-version"):
+            machine.succeed("[ `nixos-version | wc -w` = 2 ]")
+
+        with subtest("nixos-rebuild"):
+            assert "NixOS module" in machine.succeed("nixos-rebuild --help")
+
+        with subtest("Sanity check for uid/gid assignment"):
+            assert "4" == machine.succeed("id -u messagebus").strip()
+            assert "4" == machine.succeed("id -g messagebus").strip()
+            assert "users:x:100:" == machine.succeed("getent group users").strip()
+
+        with subtest("Regression test for GMP aborts on QEMU."):
+            machine.succeed("expr 1 + 2")
+
+        with subtest("the swap file got created"):
+            machine.wait_for_unit("root-swapfile.swap")
+            machine.succeed("ls -l /root/swapfile | grep 134217728")
+
+        with subtest("whether kernel.poweroff_cmd is set"):
+            machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
+
+        with subtest("whether the io cgroupv2 controller is properly enabled"):
+            machine.succeed("grep -q '\\bio\\b' /sys/fs/cgroup/cgroup.controllers")
+
+        with subtest("whether we have a reboot record in wtmp"):
+            machine.shutdown
+            machine.wait_for_unit("multi-user.target")
+            machine.succeed("last | grep reboot >&2")
+
+        with subtest("whether we can override environment variables"):
+            machine.succeed('[ "$EDITOR" = emacs ]')
+
+        with subtest("whether hostname (and by extension nss_myhostname) works"):
+            assert "machine" == machine.succeed("hostname").strip()
+            assert "machine" == machine.succeed("hostname -s").strip()
+
+        with subtest("whether systemd-udevd automatically loads modules for our hardware"):
+            machine.succeed("systemctl start systemd-udev-settle.service")
+            machine.wait_for_unit("systemd-udev-settle.service")
+            assert "mousedev" in machine.succeed("lsmod")
+
+        with subtest("whether systemd-tmpfiles-clean works"):
+            machine.succeed(
+                "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
+            )
+            # move into the future
+            machine.succeed(
+                'date -s "@$(($(date +%s) + 1000000))"',
+                "systemctl start systemd-tmpfiles-clean",
+            )
+            machine.fail("[ -e /tmp/foo ]")
+
+        with subtest("whether systemd-tmpfiles settings works"):
+            machine.succeed("[ -e /tmp/somefile ]")
+
+        with subtest("whether automounting works"):
+            machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
+            machine.succeed("touch /tmp2/x")
+            machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
+
+        with subtest(
+            "Whether mounting by a user is possible with the `user` option in fstab (#95444)"
+        ):
+            machine.succeed("mkdir -p /user-mount/source")
+            machine.succeed("touch /user-mount/source/file")
+            machine.succeed("chmod -R a+Xr /user-mount/source")
+            machine.succeed("mkdir /user-mount/point")
+            machine.succeed("chown alice:users /user-mount/point")
+            machine.succeed("su - alice -c 'mount /user-mount/point'")
+            machine.succeed("su - alice -c 'ls /user-mount/point/file'")
+        with subtest(
+            "Whether mounting by a user is denied without the `user` option in  fstab"
+        ):
+            machine.succeed("mkdir -p /user-mount/denied-source")
+            machine.succeed("touch /user-mount/denied-source/file")
+            machine.succeed("chmod -R a+Xr /user-mount/denied-source")
+            machine.succeed("mkdir /user-mount/denied-point")
+            machine.succeed("chown alice:users /user-mount/denied-point")
+            machine.fail("su - alice -c 'mount /user-mount/denied-point'")
+
+        with subtest("shell-vars"):
+            machine.succeed('[ -n "$NIX_PATH" ]')
+
+        with subtest("nix-db"):
+            machine.succeed("nix-store -qR /run/current-system | grep nixos-")
+
+        with subtest("Test sysctl"):
+            machine.wait_for_unit("systemd-sysctl.service")
+            assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
+            machine.execute("sysctl vm.swappiness=60")
+            assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
+
+        with subtest("Test boot parameters"):
+            assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
+      '';
+  });
+  in
+  tests
diff --git a/nixos/tests/private-gpt.nix b/nixos/tests/private-gpt.nix
new file mode 100644
index 0000000000000..d19e167cc303c
--- /dev/null
+++ b/nixos/tests/private-gpt.nix
@@ -0,0 +1,27 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  mainPort = "8001";
+in
+{
+  name = "private-gpt";
+  meta = with lib.maintainers; {
+    maintainers = [ drupol ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.private-gpt = {
+        enable = true;
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("private-gpt.service")
+    machine.wait_for_open_port(${mainPort})
+
+    machine.succeed("curl http://127.0.0.1:${mainPort}")
+  '';
+})
diff --git a/pkgs/applications/audio/feishin/default.nix b/pkgs/applications/audio/feishin/default.nix
index e0e35bae6df09..90561314fec90 100644
--- a/pkgs/applications/audio/feishin/default.nix
+++ b/pkgs/applications/audio/feishin/default.nix
@@ -11,13 +11,13 @@
 }:
 let
   pname = "feishin";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Nj8GwrH49ph14xvJldj5GQR4mlt9unCPEcgLrsH/sx8=";
+    hash = "sha256-eNGHrSF/MgRHh0CVc0l8denZIbAnPXwFCZJZcvF+Xtc=";
   };
 
   electron = electron_27;
@@ -26,7 +26,7 @@ buildNpmPackage {
   inherit pname version;
 
   inherit src;
-  npmDepsHash = "sha256-+pr9fWg/9kxkYMmthtqhjgF6MOomSQxVCO5V8tHHRdE=";
+  npmDepsHash = "sha256-7oh5bl5APAvzb/TxHMUP/saRWLwuP9xqGvn7/RDhFk8=";
 
   npmFlags = [ "--legacy-peer-deps" ];
   makeCacheWritable = true;
@@ -60,7 +60,7 @@ buildNpmPackage {
         inherit version;
 
         src = "${src}/release/app";
-        npmDepsHash = "sha256-MRwKxe1hoFs5bPXT6K/UspSDs9XBdcRJGvxGlTKExp4=";
+        npmDepsHash = "sha256-NgWPr3mctn7f6X2JFsbdNNHkN84RRlLAywqfbyahCQw=";
 
         npmFlags = [ "--ignore-scripts" ];
         dontNpmBuild = true;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 616d46e65190f..5bd533dd11fcc 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -15376,6 +15376,18 @@ final: prev:
     meta.homepage = "https://github.com/mhinz/vim-signify/";
   };
 
+  vim-sile = buildVimPlugin {
+    pname = "vim-sile";
+    version = "2022-09-03";
+    src = fetchFromGitHub {
+      owner = "sile-typesetter";
+      repo = "vim-sile";
+      rev = "7856f66d5e552eb18596f0162b81d8d14a4cbc16";
+      sha256 = "0xik91854jqmv3sa8af988w8xirm1vqql1ifjqxi61v00z0z00j7";
+    };
+    meta.homepage = "https://github.com/sile-typesetter/vim-sile/";
+  };
+
   vim-simpledb = buildVimPlugin {
     pname = "vim-simpledb";
     version = "2020-10-02";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 71da655f81ad1..acdd809e54387 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1295,6 +1295,7 @@ https://github.com/tpope/vim-sexp-mappings-for-regular-people/,,
 https://github.com/itspriddle/vim-shellcheck/,,
 https://github.com/kshenoy/vim-signature/,,
 https://github.com/mhinz/vim-signify/,,
+https://github.com/sile-typesetter/vim-sile/,HEAD,
 https://github.com/ivalkeen/vim-simpledb/,,
 https://github.com/junegunn/vim-slash/,,
 https://github.com/tpope/vim-sleuth/,,
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index b3f9d1916835a..b8281e83c564b 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     publisher = "myriad-dreamin";
     # Please update the corresponding binary (tinymist) when updating
     # this extension.
-    version = "0.11.7";
-    hash = "sha256-pL61pu8xTsjOOn4vYBwrWc6JKhrzRyNjQmJmrezUcyk=";
+    version = "0.11.8";
+    hash = "sha256-ELqk94xhPJwHlxQ0ie9DMBNOiqszpi3mYF+wHxoY2xw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/emulators/retroarch/hashes.json b/pkgs/applications/emulators/retroarch/hashes.json
index a612379f0e692..d1ea92493c1c5 100644
--- a/pkgs/applications/emulators/retroarch/hashes.json
+++ b/pkgs/applications/emulators/retroarch/hashes.json
@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "54afe0284292fc6b83b9d515c86a553a8127a984",
-            "hash": "sha256-VZq8AZzjnTFh0GHh1mGIVAznTtJ+g0TJwTAXPUJdmI4="
+            "rev": "0c8abf7f9dda23874b5b9cecfcec519a9dfb032b",
+            "hash": "sha256-psGXpYzKI1QicoHxGhHwR92kymZ+9EaJUpGMcM2OMUY="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -287,10 +287,10 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "3ece23fb10085098ac679f6bb61c20046b4a4b88",
-            "hash": "sha256-9dXQHkVYurUFnpnszGpdcTz/OcZh2J245O5r8gU5EQ8="
+            "rev": "573c9b99e3cc0b11a652b2f21a22dcb15a2c4dda",
+            "hash": "sha256-MTRv/F68GiEwt5iN4xilTWGgTw2mf2aAvqDExgeN/g0="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-07"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
@@ -307,11 +307,11 @@
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "0517a4600c46aa7f3db69eb827a5fcba40a1bda9",
-            "hash": "sha256-1tW6AwnzIZmiyQI8QFKn0ggBifONYR15tXSaRFu7n4k=",
+            "rev": "f13d7ad2dcf141f59a999090dbc0f78be196e665",
+            "hash": "sha256-YFLSUaEikwLPglHh3t8sHiKHRn5cchKzzkJlZDdgVsU=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-11"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -348,20 +348,20 @@
         "src": {
             "owner": "libretro",
             "repo": "gambatte-libretro",
-            "rev": "1030f93780121359d058a7f9eca081286906d88b",
-            "hash": "sha256-nnV1le7H22tY90G8/jCYy+9LPaY32G//7S48RotUyT8="
+            "rev": "a7e645196f5e54904a056e390ac7ceb033037de0",
+            "hash": "sha256-pz/IQpjySByHnRu64Ysd1LJPrcImMQ0CfTRV4ONUsA0="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "genesis-plus-gx": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "Genesis-Plus-GX",
-            "rev": "86f701ba43953152d0db4e1cf548395ff7a57f1d",
-            "hash": "sha256-pDXxGrHX7XUvZNDLuASEfVGDiP07SZFHg21ZiRzJFDU="
+            "rev": "ba9fc37cfa4930311a9c77b1d8a23df0cae95e9a",
+            "hash": "sha256-Smw0MoUfewlz0zYQmtFLB0n8l0KyyoInohXZ7d9Xrwk="
         },
-        "version": "unstable-2024-05-03"
+        "version": "unstable-2024-05-10"
     },
     "gpsp": {
         "fetcher": "fetchFromGitHub",
@@ -601,10 +601,10 @@
         "src": {
             "owner": "libretro",
             "repo": "opera-libretro",
-            "rev": "cacba231c3bd71833f06943e230fe03d8ebec0ab",
-            "hash": "sha256-pWLcolQw5ctWrL7YQUaUK04QPS4ReUeJhdig3O5T8BM="
+            "rev": "5121aa6d36eff884bd56ccbadb6c112f1e951fee",
+            "hash": "sha256-mD/BEUwbWmRtB9llsqhz+/DhrzH9HiuXyJkX0pBks5M="
         },
-        "version": "unstable-2024-04-24"
+        "version": "unstable-2024-05-06"
     },
     "parallel-n64": {
         "fetcher": "fetchFromGitHub",
@@ -674,10 +674,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-prboom",
-            "rev": "6ec854969fd9dec33bb2cab350f05675d1158969",
-            "hash": "sha256-y0qZwYNwcO4ofWDZ7UXN9ZVMPFxjCnLDDZKBMdZLxEY="
+            "rev": "ab05295d81fed2bb9db9f68a7ceeec7a544191d8",
+            "hash": "sha256-ekVVxYg+Uet3pfir6P7PwI87p5XF2ATbFbux1t38ETs="
         },
-        "version": "unstable-2023-05-28"
+        "version": "unstable-2024-05-07"
     },
     "prosystem": {
         "fetcher": "fetchFromGitHub",
@@ -694,10 +694,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-uae",
-            "rev": "4806716da70cf1f030788b43190d71aae61e2041",
-            "hash": "sha256-MNqk8ItSC//82HsRfXVYCH+Xd2GV8OA/2heZprx89PY="
+            "rev": "106b98d50dab4b5648067096f0ba54acbf713fd3",
+            "hash": "sha256-UtZETlFrK59P6IK2i9Kt8qxRV8aEDMqxH7Oigm5sc1g="
         },
-        "version": "unstable-2024-04-19"
+        "version": "unstable-2024-05-04"
     },
     "quicknes": {
         "fetcher": "fetchFromGitHub",
@@ -814,10 +814,10 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "6ed491d6ba46ac8ba64a580b3004a163c0725bd2",
-            "hash": "sha256-JRo1+zFBBtO0Ws7x32bltcm5WoDSIZBgLdPl75lpKAo="
+            "rev": "929958a1acaa075e32e108118b550e0449540cb6",
+            "hash": "sha256-UofVxdi+e1Y9d0ML/8lGahJCx5xnW5j9oDssRKrxYLU="
         },
-        "version": "unstable-2024-04-26"
+        "version": "unstable-2024-05-06"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
diff --git a/pkgs/applications/finance/irpf/default.nix b/pkgs/applications/finance/irpf/default.nix
index b693aee613f74..9bf9c1f2d0cc5 100644
--- a/pkgs/applications/finance/irpf/default.nix
+++ b/pkgs/applications/finance/irpf/default.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "irpf";
-  version = "2024-1.0";
+  version = "2024-1.1";
 
   # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
   # Para outros sistemas operacionais -> Multi
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {
     year = lib.head (lib.splitVersion version);
   in fetchzip {
     url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${version}.zip";
-    hash = "sha256-x47Ud/aSfPuZYMZSGhJLnNFtNE62I+WjaFFatJPMPYg=";
+    hash = "sha256-7Eh5XhZKs2DAQC33ICUG+mgjEU7H3jdYZSeiHNJ6I6Q=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper copyDesktopItems ];
@@ -71,7 +71,7 @@ stdenvNoCC.mkDerivation rec {
     license = licenses.unfree;
     platforms = platforms.all;
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
-    maintainers = with maintainers; [ atila ];
+    maintainers = with maintainers; [ atila bryanasdev000 ];
     mainProgram = "irpf";
   };
 }
diff --git a/pkgs/applications/misc/waypaper/default.nix b/pkgs/applications/misc/waypaper/default.nix
index 2722d8782fb4d..a8dae9664264b 100644
--- a/pkgs/applications/misc/waypaper/default.nix
+++ b/pkgs/applications/misc/waypaper/default.nix
@@ -8,13 +8,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "waypaper";
-  version = "2.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "anufrievroman";
     repo = "waypaper";
     rev = "refs/tags/${version}";
-    hash = "sha256-AIOrn5I0WX8S4iaK6mVEbdn1tQiED0JYA0GXDXJ6eNE=";
+    hash = "sha256-GB+H2kZr1+UhhGFpfXc3V4DPXjvHBdg6EKNEFhjKEHk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/cilium/default.nix b/pkgs/applications/networking/cluster/cilium/default.nix
index 6b097500bacc5..5353078e1d157 100644
--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.6";
+  version = "0.16.7";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MeBwlwxjMcBMy62IlhWBB+hTM5/Z9uIlqfCWsj0SQ4g=";
+    hash = "sha256-+Uxn9yR3D38CuvFeBA62aWLtY4rPrBJoF3tUmgKvKpw=";
   };
 
   vendorHash = null;
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
index f768404e08fa2..bd93089ee3063 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-unittest.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-unittest";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DGmvF4U+yqXWm/L96ph+/OrLZ7q+JG4PQQFxC7pH710=";
+    hash = "sha256-YWzjv1/I+LX3AMeQenI36AsNJkZ6IzbMhM/f5/Kxs2M=";
   };
 
-  vendorHash = "sha256-BRFKrrJ9PhwMrfr3ON4/sm+BQ1ufeyP5PtfJQRksrj0=";
+  vendorHash = "sha256-A2izHBh58yPd2XPm4GKVosPtahUtQ35GbyBdr/L13CQ=";
 
   # NOTE: Remove the install and upgrade hooks.
   postPatch = ''
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 5a55476d4b9e4..4c4c6ef1df6c4 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -1,47 +1,8 @@
-{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu, fetchpatch2 }:
+{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu, fetchpatch2, config }:
 
 rec {
   thunderbird = thunderbird-115;
 
-  thunderbird-102 = (buildMozillaMach rec {
-    pname = "thunderbird";
-    version = "102.14.0";
-    application = "comm/mail";
-    applicationName = "Mozilla Thunderbird";
-    binaryName = pname;
-    src = fetchurl {
-      url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-      hash = "sha512-SuPyFoM67FVCH4J9VbwbX8LwrU/v7LJ3JKW+MxjDUd8k0wpIl7kk5zPtLjmVvihLbRNQSdRgARQ/sclh/vwYMA==";
-    };
-    extraPatches = [
-      # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
-      ./no-buildconfig.patch
-    ];
-
-    meta = with lib; {
-      changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
-      description = "A full-featured e-mail client";
-      homepage = "https://thunderbird.net/";
-      mainProgram = "thunderbird";
-      maintainers = with maintainers; [ eelco lovesegfault pierron vcunat ];
-      platforms = platforms.unix;
-      badPlatforms = platforms.darwin;
-      broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
-                                             # not in `badPlatforms` because cross-compilation on 64-bit machine might work.
-      license = licenses.mpl20;
-      knownVulnerabilities = [ "Thunderbird 102 support has ended" ];
-    };
-    updateScript = callPackage ./update.nix {
-      attrPath = "thunderbird-unwrapped";
-      versionPrefix = "102";
-    };
-  }).override {
-    geolocationSupport = false;
-    webrtcSupport = false;
-
-    pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
-  };
-
   thunderbird-115 = (buildMozillaMach rec {
     pname = "thunderbird";
     version = "115.10.1";
@@ -91,3 +52,7 @@ rec {
     });
   };
 }
+ // lib.optionalAttrs config.allowAliases {
+  thunderbird-102 = throw "Thunderbird 102 support ended in September 2023";
+}
+
diff --git a/pkgs/applications/networking/weather/meteo/default.nix b/pkgs/applications/networking/weather/meteo/default.nix
index ddee458a0569f..9914f664d0b02 100644
--- a/pkgs/applications/networking/weather/meteo/default.nix
+++ b/pkgs/applications/networking/weather/meteo/default.nix
@@ -11,6 +11,7 @@
 , vala
 , wrapGAppsHook3
 , glib
+, glib-networking
 , gtk3
 , json-glib
 , libappindicator
@@ -42,6 +43,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
+    glib-networking # see #311066
     gtk3
     json-glib
     libappindicator
diff --git a/pkgs/applications/video/mpv/scripts/evafast.nix b/pkgs/applications/video/mpv/scripts/evafast.nix
index 8ba1109ff2d57..5260adb1a8efd 100644
--- a/pkgs/applications/video/mpv/scripts/evafast.nix
+++ b/pkgs/applications/video/mpv/scripts/evafast.nix
@@ -16,7 +16,8 @@ buildLua {
     hash = "sha256-BGWD2XwVu8zOSiDJ+9oWi8aPN2Wkw0Y0gF58X4f+tdI=";
   };
 
-  passthru.updateScript = unstableGitUpdater { };
+  # Drop the `branch` parameter once upstream merges `rewrite` back into `master`
+  passthru.updateScript = unstableGitUpdater { branch = "rewrite"; };
 
   meta = with lib; {
     description = "Seeking and hybrid fastforwarding like VHS";
diff --git a/pkgs/by-name/ca/catppuccin-sddm/package.nix b/pkgs/by-name/ca/catppuccin-sddm/package.nix
new file mode 100644
index 0000000000000..1daab09ae646d
--- /dev/null
+++ b/pkgs/by-name/ca/catppuccin-sddm/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  just,
+  kdePackages,
+  flavor ? "mocha",
+  font ? "Noto Sans",
+  fontSize ? "9",
+  background ? null,
+  loginBackground ? false,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "catppuccin-sddm";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "catppuccin";
+    repo = "sddm";
+    rev = "v${version}";
+    hash = "sha256-SdpkuonPLgCgajW99AzJaR8uvdCPi4MdIxS5eB+Q9WQ=";
+  };
+
+  dontWrapQtApps = true;
+
+  nativeBuildInputs = [
+    just
+  ];
+
+  propagatedBuildInputs = [
+    kdePackages.qtsvg
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    just build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/sddm/themes/"
+    cp -r dist/catppuccin-${flavor} "$out/share/sddm/themes/catppuccin-${flavor}"
+
+    configFile=$out/share/sddm/themes/catppuccin-${flavor}/theme.conf
+
+    substituteInPlace $configFile \
+      --replace-fail 'Font="Noto Sans"' 'Font="${font}"' \
+      --replace-fail 'FontSize=9' 'FontSize=${fontSize}'
+
+    ${lib.optionalString (background != null) ''
+      substituteInPlace $configFile \
+        --replace-fail 'Background="backgrounds/wall.jpg"' 'Background="${background}"' \
+        --replace-fail 'CustomBackground="false"' 'CustomBackground="true"'
+    ''}
+
+    ${lib.optionalString loginBackground ''
+      substituteInPlace $configFile \
+        --replace-fail 'LoginBackground="false"' 'LoginBackground="true"'
+    ''}
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    mkdir -p $out/nix-support
+    echo ${kdePackages.qtsvg} >> $out/nix-support/propagated-user-env-packages
+  '';
+
+  meta = {
+    description = "Soothing pastel theme for SDDM";
+    homepage = "https://github.com/catppuccin/sddm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [elysasrc];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/cr/crunchy-cli/Cargo.lock b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
index 61832fee845ba..44a47cd532dea 100644
--- a/pkgs/by-name/cr/crunchy-cli/Cargo.lock
+++ b/pkgs/by-name/cr/crunchy-cli/Cargo.lock
@@ -43,47 +43,48 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.13"
+version = "0.6.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d96bd03f33fe50a863e394ee9718a706f988b9079b20c3784fb726e7678b62fb"
+checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
  "anstyle-query",
  "anstyle-wincon",
  "colorchoice",
+ "is_terminal_polyfill",
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle"
-version = "1.0.6"
+version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8901269c6307e8d93993578286ac0edf7f195079ffff5ebdeea6a59ffb7e36bc"
+checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c75ac65da39e5fe5ab759307499ddad880d724eed2f6ce5b5e8a26f4f387928c"
+checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e28923312444cdd728e4738b3f9c9cac739500909bb3d3c94b43551b16517648"
+checksum = "a64c907d4e79225ac72e2a354c9ce84d50ebb4586dee56c82b3ee73004f537f5"
 dependencies = [
  "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.2"
+version = "3.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cd54b81ec8d6180e24654d0b371ad22fc3dd083b6ff8ba325b72e00c87660a7"
+checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
 dependencies = [
  "anstyle",
  "windows-sys 0.52.0",
@@ -91,9 +92,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.82"
+version = "1.0.83"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f538837af36e6f6a9be0faa67f9a314f8119e4e4b5867c6ab40ed60360142519"
+checksum = "25bdb32cbbdce2b519a9cd7df3a678443100e265d5e25ca763b7572a5104f5f3"
 
 [[package]]
 name = "async-speed-limit"
@@ -120,9 +121,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.2.0"
+version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fdabc7756949593fe60f30ec81974b613357de856987752631dea1e3394c80"
+checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
 
 [[package]]
 name = "backtrace"
@@ -147,9 +148,9 @@ checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
 
 [[package]]
 name = "base64"
-version = "0.22.0"
+version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9475866fec1451be56a3c2400fd081ff546538961565ccb5b7142cbd22bc7a51"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "base64-serde"
@@ -180,18 +181,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
 
 [[package]]
-name = "bytemuck"
-version = "1.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d6d68c57235a3a081186990eca2867354726650f42f7516ca50c28d6281fd15"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
 name = "bytes"
 version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -199,9 +188,9 @@ checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
 
 [[package]]
 name = "cc"
-version = "1.0.95"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32a725bc159af97c3e629873bb9f88fb8cf8a4867175f76dc987815ea07c83b"
+checksum = "099a5357d84c4c61eb35fc8eafa9a79a902c2f76911e5747ced4e032edd8d9b4"
 
 [[package]]
 name = "cfg-if"
@@ -291,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "acbf1af155f9b9ef647e42cdc158db4b64a1b61f743629225fde6f3e0be2a7c7"
+checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
 
 [[package]]
 name = "console"
@@ -354,7 +343,7 @@ checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
 
 [[package]]
 name = "crunchy-cli"
-version = "3.5.2"
+version = "3.6.1"
 dependencies = [
  "chrono",
  "clap",
@@ -367,7 +356,7 @@ dependencies = [
 
 [[package]]
 name = "crunchy-cli-core"
-version = "3.5.2"
+version = "3.6.1"
 dependencies = [
  "anyhow",
  "async-speed-limit",
@@ -381,8 +370,6 @@ dependencies = [
  "fs2",
  "futures-util",
  "http",
- "image",
- "image_hasher",
  "indicatif",
  "lazy_static",
  "log",
@@ -390,7 +377,9 @@ dependencies = [
  "num_cpus",
  "regex",
  "reqwest",
+ "rsubs-lib",
  "rustls-native-certs",
+ "rusty-chromaprint",
  "serde",
  "serde_json",
  "serde_plain",
@@ -404,9 +393,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e63a541bdcf0170a29eab4015943e8a6a09281334b4beacd70ac5cfc1c19496b"
+checksum = "58580acc9c0abf96a231ec8b1a4597ea55d9426ea17f684ce3582e2b26437bbb"
 dependencies = [
  "async-trait",
  "chrono",
@@ -430,9 +419,9 @@ dependencies = [
 
 [[package]]
 name = "crunchyroll-rs-internal"
-version = "0.11.0"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a9e0e09162451565645fdd4dadc6b38e09f3aafcfb477153584bedd8d62a358"
+checksum = "ce3c844dec8a3390f8c9853b5cf1d65c3d38fd0657b8b5d0e008db8945dea326"
 dependencies = [
  "darling",
  "quote",
@@ -490,7 +479,7 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "79b4bdd5f1c0c7493d780c645f0bff5b9361e6408210fa88910adb181efca64c"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "base64-serde",
  "chrono",
  "fs-err",
@@ -601,9 +590,9 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
 
 [[package]]
 name = "fnv"
@@ -723,9 +712,9 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.2.14"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94b22e06ecb0110981051723910cbf0b5f5e09a2062dd7663334ee79a9d1286c"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "js-sys",
@@ -767,9 +756,9 @@ checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 
 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
 
 [[package]]
 name = "heck"
@@ -952,32 +941,6 @@ dependencies = [
 ]
 
 [[package]]
-name = "image"
-version = "0.25.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fd54d660e773627692c524beaad361aca785a4f9f5730ce91f42aabe5bce3d11"
-dependencies = [
- "bytemuck",
- "byteorder",
- "num-traits",
- "zune-core",
- "zune-jpeg",
-]
-
-[[package]]
-name = "image_hasher"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9481465fe767d92494987319b0b447a5829edf57f09c52bf8639396abaaeaf78"
-dependencies = [
- "base64 0.22.0",
- "image",
- "rustdct",
- "serde",
- "transpose",
-]
-
-[[package]]
 name = "indexmap"
 version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -995,7 +958,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "168fb715dda47215e360912c096649d23d58bf392ac62f73919e831745e40f26"
 dependencies = [
  "equivalent",
- "hashbrown 0.14.3",
+ "hashbrown 0.14.5",
  "serde",
 ]
 
@@ -1028,6 +991,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f518f335dce6725a761382244631d86cf0ccb2863413590b31338feb467f9c3"
 
 [[package]]
+name = "is_terminal_polyfill"
+version = "1.70.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+
+[[package]]
 name = "iso8601"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1072,9 +1041,9 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
 
 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"
 
 [[package]]
 name = "libredox"
@@ -1210,9 +1179,9 @@ dependencies = [
 
 [[package]]
 name = "num-traits"
-version = "0.2.18"
+version = "0.2.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da0df0e5185db44f69b44f26786fe401b6c293d1907744beaa7fa62b2e5a517a"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
 dependencies = [
  "autocfg",
 ]
@@ -1418,6 +1387,15 @@ dependencies = [
 ]
 
 [[package]]
+name = "realfft"
+version = "3.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953d9f7e5cdd80963547b456251296efc2626ed4e3cbf36c869d9564e0220571"
+dependencies = [
+ "rustfft",
+]
+
+[[package]]
 name = "redox_users"
 version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1463,7 +1441,7 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "bytes",
  "cookie",
  "cookie_store",
@@ -1532,21 +1510,34 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b833d8d034ea094b1ea68aa6d5c740e0d04bad9d16568d08ba6f76823a114316"
 
 [[package]]
-name = "rustc-demangle"
-version = "0.1.23"
+name = "rsubs-lib"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+checksum = "9dcca2a9560fca05de8f95bc3767e46673d4b4c1f2c7a11092e10efd95bbdf62"
+dependencies = [
+ "regex",
+ "serde",
+]
 
 [[package]]
-name = "rustdct"
-version = "0.7.1"
+name = "rubato"
+version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b61555105d6a9bf98797c063c362a1d24ed8ab0431655e38f1cf51e52089551"
+checksum = "e6dd52e80cfc21894deadf554a5673002938ae4625f7a283e536f9cf7c17b0d5"
 dependencies = [
- "rustfft",
+ "num-complex",
+ "num-integer",
+ "num-traits",
+ "realfft",
 ]
 
 [[package]]
+name = "rustc-demangle"
+version = "0.1.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d626bb9dae77e28219937af045c257c28bfd3f69333c512553507f5f9798cb76"
+
+[[package]]
 name = "rustfft"
 version = "6.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1607,7 +1598,7 @@ version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29993a25686778eb88d4189742cd713c9bce943bc54251a33509dc63cbacf73d"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "rustls-pki-types",
 ]
 
@@ -1629,6 +1620,16 @@ dependencies = [
 ]
 
 [[package]]
+name = "rusty-chromaprint"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1755646867c36ecb391776deaa0b557a76d3badf20c142de7282630c34b20440"
+dependencies = [
+ "rubato",
+ "rustfft",
+]
+
+[[package]]
 name = "ryu"
 version = "1.0.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1645,11 +1646,11 @@ dependencies = [
 
 [[package]]
 name = "security-framework"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "770452e37cad93e0a50d5abc3990d2bc351c36d0328f86cefec2f2fb206eaef6"
+checksum = "c627723fd09706bacdb5cf41499e95098555af3c3c29d014dc3c458ef6be11c0"
 dependencies = [
- "bitflags 1.3.2",
+ "bitflags 2.5.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -1658,9 +1659,9 @@ dependencies = [
 
 [[package]]
 name = "security-framework-sys"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f3cc463c0ef97e11c3461a9d3787412d30e8e7eb907c79180c4a57bf7c04ef"
+checksum = "317936bbbd05227752583946b9e66d7ce3b489f84e11a94a510b4437fef407d7"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -1668,18 +1669,18 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
+checksum = "ddc6f9cc94d67c0e21aaf7eda3a010fd3af78ebf6e096aa6e2e13c79749cce4f"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.198"
+version = "1.0.200"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
+checksum = "856f046b9400cee3c8c94ed572ecdb752444c24528c035cd35882aad6f492bcb"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1730,11 +1731,11 @@ dependencies = [
 
 [[package]]
 name = "serde_with"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c85f8e96d1d6857f13768fcbd895fcb06225510022a2774ed8b5150581847b0"
+checksum = "0ad483d2ab0149d5a5ebcd9972a3852711e0153d863bf5a5d0391d28883c4a20"
 dependencies = [
- "base64 0.22.0",
+ "base64 0.22.1",
  "chrono",
  "hex",
  "indexmap 1.9.3",
@@ -1748,9 +1749,9 @@ dependencies = [
 
 [[package]]
 name = "serde_with_macros"
-version = "3.8.0"
+version = "3.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8b3a576c4eb2924262d5951a3b737ccaf16c931e39a2810c36f9a7e25575557"
+checksum = "65569b702f41443e8bc8bbb1c5779bd0450bbe723b56198980e80ec45780bce2"
 dependencies = [
  "darling",
  "proc-macro2",
@@ -1798,9 +1799,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05ffd9c0a93b7543e062e759284fcf5f5e3b098501104bfbdde4d404db792871"
+checksum = "ce305eb0b4296696835b71df73eb912e0f1ffd2556a501fcede6e0c50349191c"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -2024,16 +2025,15 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.10"
+version = "0.7.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5419f34732d9eb6ee4c3578b7989078579b7f039cbbb9ca2c4da015749371e15"
+checksum = "9cf6b47b3771c49ac75ad09a6162f53ad4b8088b76ac60e8ec1455b31a189fe1"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
  "tokio",
- "tracing",
 ]
 
 [[package]]
@@ -2144,9 +2144,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-width"
-version = "0.1.11"
+version = "0.1.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+checksum = "68f5e5f3158ecfd4b8ff6fe086db7c8467a2dfdac97fe420f2b7c4aa97af66d6"
 
 [[package]]
 name = "untrusted"
@@ -2498,21 +2498,6 @@ dependencies = [
 
 [[package]]
 name = "zeroize"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "63381fa6624bf92130a6b87c0d07380116f80b565c42cf0d754136f0238359ef"
-
-[[package]]
-name = "zune-core"
-version = "0.4.12"
+version = "1.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f423a2c17029964870cfaabb1f13dfab7d092a62a29a89264f4d36990ca414a"
-
-[[package]]
-name = "zune-jpeg"
-version = "0.4.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec866b44a2a1fd6133d363f073ca1b179f438f99e7e5bfb1e33f7181facfe448"
-dependencies = [
- "zune-core",
-]
+checksum = "525b4ec142c6b68a2d10f01f7bbf6755599ca3f81ea53b8431b7dd348f5fdb2d"
diff --git a/pkgs/by-name/cr/crunchy-cli/package.nix b/pkgs/by-name/cr/crunchy-cli/package.nix
index 1fc5711ef3508..0855864a3fe8a 100644
--- a/pkgs/by-name/cr/crunchy-cli/package.nix
+++ b/pkgs/by-name/cr/crunchy-cli/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "crunchy-cli";
-  version = "3.5.2";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "crunchy-labs";
     repo = "crunchy-cli";
     rev = "v${version}";
-    hash = "sha256-20jsBIjl6WOs0X4ancWHUuAe2Qiv8s4w+EpEVE5Psvw=";
+    hash = "sha256-SlTdyEeqQ9lCrFFTDtMhP0Kvm+3gxiUS+ZB5LvNWSZU=";
   };
 
   cargoLock = {
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index adb9b6694024e..886bf6297c858 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.13.27";
+  version = "2.13.41";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-UbABURsoQkTwYvQqR7Eg8ti56JQKnIcAm78Tmu+W+ls=";
+    hash = "sha256-WW6E0K3HOi8gtBwcmN9syV4wM73BPGyXbv3t4ZJjoIc=";
   };
 
-  vendorHash = "sha256-8xiIMl4eAFMvMsN5Y+ruw04BtdA+mrCnqxsoekyr4Bo=";
+  vendorHash = "sha256-LdebAbdbiUX0xw1EJKCzK1jdt5+FgoZQBPI0apZkcsc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fo/forbidden/package.nix b/pkgs/by-name/fo/forbidden/package.nix
index adbd83ada4b08..a3f57a4a05ddc 100644
--- a/pkgs/by-name/fo/forbidden/package.nix
+++ b/pkgs/by-name/fo/forbidden/package.nix
@@ -5,23 +5,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "forbidden";
-  version = "10.8";
+  version = "10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ivan-sincek";
     repo = "forbidden";
     rev = "refs/tags/v${version}";
-    hash = "sha256-jitmgN+We6m5CTgRc1NYwZkg5GYvD6ZlJ8FKtTa+rAY=";
+    hash = "sha256-LggF9giKKKO2F65zS0lPCshaDauy+s6YyRGr3BL0tJU=";
   };
 
-  pythonRemoveDeps = [
-    # https://github.com/ivan-sincek/forbidden/pull/3
-    "argparse"
-  ];
-
   build-system = with python3.pkgs; [
-    pythonRelaxDepsHook
     setuptools
   ];
 
diff --git a/pkgs/by-name/pr/private-gpt/package.nix b/pkgs/by-name/pr/private-gpt/package.nix
new file mode 100644
index 0000000000000..1b717cc2bfb83
--- /dev/null
+++ b/pkgs/by-name/pr/private-gpt/package.nix
@@ -0,0 +1,17 @@
+{ python3Packages
+, makeBinaryWrapper
+}:
+
+python3Packages.toPythonApplication (python3Packages.private-gpt.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ makeBinaryWrapper ];
+
+  passthru.cl100k_base = {
+    inherit (python3Packages.private-gpt.cl100k_base) tiktoken;
+  };
+
+  postInstall = ''
+    makeWrapper ${python3Packages.python.interpreter} $out/bin/private-gpt \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --add-flags "-m private_gpt"
+  '';
+}))
diff --git a/pkgs/by-name/sa/sarif-tools/package.nix b/pkgs/by-name/sa/sarif-tools/package.nix
new file mode 100644
index 0000000000000..881c2604eef96
--- /dev/null
+++ b/pkgs/by-name/sa/sarif-tools/package.nix
@@ -0,0 +1,4 @@
+{ python3Packages }:
+
+with python3Packages;
+toPythonApplication sarif-tools
diff --git a/pkgs/by-name/ti/tinymist/Cargo.lock b/pkgs/by-name/ti/tinymist/Cargo.lock
index b561b67c1088d..d841971169afe 100644
--- a/pkgs/by-name/ti/tinymist/Cargo.lock
+++ b/pkgs/by-name/ti/tinymist/Cargo.lock
@@ -29,6 +29,18 @@ dependencies = [
 ]
 
 [[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
 name = "aho-corasick"
 version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -38,6 +50,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "allocator-api2"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c6cb57a04249c6480766f7f7cef5467412af1490f8d1e243141daddada3264f"
+
+[[package]]
 name = "android-tzdata"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -122,6 +140,12 @@ dependencies = [
 ]
 
 [[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
+[[package]]
 name = "arrayref"
 version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -1468,7 +1492,7 @@ version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
 dependencies = [
- "ahash",
+ "ahash 0.7.8",
 ]
 
 [[package]]
@@ -1476,6 +1500,19 @@ name = "hashbrown"
 version = "0.14.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+dependencies = [
+ "ahash 0.8.11",
+ "allocator-api2",
+]
+
+[[package]]
+name = "hashlink"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8094feaf31ff591f651a2664fb9cfd92bba7a60ce3197265e9482ebe753c8f7"
+dependencies = [
+ "hashbrown 0.14.3",
+]
 
 [[package]]
 name = "hayagriva"
@@ -3681,7 +3718,7 @@ dependencies = [
 
 [[package]]
 name = "tests"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "insta",
  "lsp-server",
@@ -3778,7 +3815,7 @@ dependencies = [
 
 [[package]]
 name = "tinymist"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3829,9 +3866,10 @@ dependencies = [
 
 [[package]]
 name = "tinymist-query"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "anyhow",
+ "biblatex",
  "comemo 0.4.0",
  "ecow 0.2.2",
  "ena",
@@ -3854,7 +3892,9 @@ dependencies = [
  "rust_iso639",
  "serde",
  "serde_json",
+ "serde_yaml",
  "sha2",
+ "siphasher 1.0.1",
  "strum 0.26.2",
  "toml 0.8.12",
  "ttf-parser",
@@ -3863,11 +3903,12 @@ dependencies = [
  "typst-ts-core",
  "unscanny",
  "walkdir",
+ "yaml-rust2",
 ]
 
 [[package]]
 name = "tinymist-render"
-version = "0.11.6"
+version = "0.11.8"
 dependencies = [
  "base64 0.22.0",
  "log",
@@ -4131,7 +4172,7 @@ checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
 [[package]]
 name = "typst"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "az",
  "bitflags 2.5.0",
@@ -4198,7 +4239,7 @@ checksum = "f13f85360328da54847dd7fefaf272dfa5b6d1fdeb53f32938924c39bf5b2c6c"
 [[package]]
 name = "typst-macros"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "heck 0.4.1",
  "proc-macro2",
@@ -4209,7 +4250,7 @@ dependencies = [
 [[package]]
 name = "typst-pdf"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "base64 0.22.0",
  "bytemuck",
@@ -4269,7 +4310,7 @@ dependencies = [
 [[package]]
 name = "typst-render"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "bytemuck",
  "comemo 0.4.0",
@@ -4289,7 +4330,7 @@ dependencies = [
 [[package]]
 name = "typst-svg"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "base64 0.22.0",
  "comemo 0.4.0",
@@ -4322,7 +4363,7 @@ dependencies = [
 [[package]]
 name = "typst-syntax"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "comemo 0.4.0",
  "ecow 0.2.2",
@@ -4338,7 +4379,7 @@ dependencies = [
 [[package]]
 name = "typst-timing"
 version = "0.11.0"
-source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0#88608109579929b0c1fbab12d7a2afaea0baaf74"
+source = "git+https://github.com/Myriad-Dreamin/typst.git?branch=tinymist-v0.11.0-2#6f1cdbb625fd16ad2f26466f4d72818ac24b83d9"
 dependencies = [
  "parking_lot",
  "serde",
@@ -4458,9 +4499,9 @@ dependencies = [
 
 [[package]]
 name = "typstyle"
-version = "0.11.14"
+version = "0.11.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f701eb3c275c8250b3e5e18c3c081e36861cdd5b2e78538ff4984735cbfd9591"
+checksum = "b25283094eca3cf1200a2105bb339f367e1fb127e69b22ae106d7e706d7eb08d"
 dependencies = [
  "anyhow",
  "clap",
@@ -5133,6 +5174,17 @@ dependencies = [
 ]
 
 [[package]]
+name = "yaml-rust2"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "498f4d102a79ea1c9d4dd27573c0fc96ad74c023e8da38484e47883076da25fb"
+dependencies = [
+ "arraydeque",
+ "encoding_rs",
+ "hashlink",
+]
+
+[[package]]
 name = "yoke"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -5157,6 +5209,26 @@ dependencies = [
 ]
 
 [[package]]
+name = "zerocopy"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74d4d3961e53fa4c9a25a8637fc2bfaf2595b3d3ae34875568a5cf64787716be"
+dependencies = [
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce1b18ccd8e73a9321186f97e46f9f04b778851177567b1975109d26a08d2a6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.55",
+]
+
+[[package]]
 name = "zerofrom"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index da21891455818..9849b56f1eef0 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -13,19 +13,19 @@ rustPlatform.buildRustPackage rec {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.11.6";
+  version = "0.11.8";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     rev = "v${version}";
-    hash = "sha256-7YG15kt+pIxAK22QYiTApu5lBV6Afe3Jss6L5dTGsGI=";
+    hash = "sha256-1mgtyOXSvovO2f4XSdirzTIcUlbFoT9t/UFa2uW5CpI=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "typst-0.11.0" = "sha256-UzZ0tbC6Dhn178GQDyLl70WTp3h5WdaBCsEKgLisZ2M=";
+      "typst-0.11.0" = "sha256-J3oSrxylR00r3Tc4KDmuW6ungQkoYJiI7cZEpbyyNsc=";
       "typst-syntax-0.7.0" = "sha256-yrtOmlFAKOqAmhCP7n0HQCOQpU3DWyms5foCdUb9QTg=";
       "typstfmt_lib-0.2.7" = "sha256-LBYsTCjZ+U+lgd7Z3H1sBcWwseoHsuepPd66bWgfvhI=";
     };
diff --git a/pkgs/by-name/to/tootik/package.nix b/pkgs/by-name/to/tootik/package.nix
index 9b236aabc6d94..c3b81e1722823 100644
--- a/pkgs/by-name/to/tootik/package.nix
+++ b/pkgs/by-name/to/tootik/package.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tootik";
-  version = "0.10.4";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "dimkr";
     repo = "tootik";
     rev = version;
-    hash = "sha256-7rdDVxfTYcj6Wcoxrb5xCbpEYVTHQpocM27mSezkpoE=";
+    hash = "sha256-aAIyEUeIZvDbWfUcfcETGrB3Md8GqRB8hvRBUtMU5Zs=";
   };
 
-  vendorHash = "sha256-Lsc8nK4I1gZEW7RbEapHr3IJ6wTATLElX3XfNX1LwvM=";
+  vendorHash = "sha256-kAnGMNBWqH37QETnn2ncp7qOaCSx6Xd4HCFhCehh/kU=";
 
   nativeBuildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/tr/troubadix/package.nix b/pkgs/by-name/tr/troubadix/package.nix
index 9575a83ce48f4..d70553604bc38 100644
--- a/pkgs/by-name/tr/troubadix/package.nix
+++ b/pkgs/by-name/tr/troubadix/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.4.1";
+  version = "24.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-+JrMUog04SS24ZKiBFB46AyYTDzVu7d4IdoX9SRMhpk=";
+    hash = "sha256-kA+9zcP3unNb2tE3OU8J/3xHX+pRZ/06lEQtH/0QEk4=";
   };
 
   pythonRelaxDeps = [ "validators" ];
diff --git a/pkgs/data/fonts/iosevka/default.nix b/pkgs/data/fonts/iosevka/default.nix
index 6b715e580fe54..5628df5393cfe 100644
--- a/pkgs/data/fonts/iosevka/default.nix
+++ b/pkgs/data/fonts/iosevka/default.nix
@@ -55,16 +55,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "30.0.0";
+  version = "30.0.1";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-V+oRmrqeIdYDaHmX7zCt7+So9tHOsJbqF0cBhCoctSU=";
+    hash = "sha256-THs6kN5VZpTvzTK7w/sGQbxoEyyPwzl93JDOvwucgeo=";
   };
 
-  npmDepsHash = "sha256-vRk7yUL+st/1kwNItLhypF22A8YuOG7e3vfoZwB0+oo=";
+  npmDepsHash = "sha256-maDIkbe4BKY7XYOQNGdOalyTGdBXgIU5t0QjVJW6lvQ=";
 
   nativeBuildInputs = [
     remarshal
diff --git a/pkgs/data/icons/kora-icon-theme/default.nix b/pkgs/data/icons/kora-icon-theme/default.nix
index a490d1c7289a5..6ff07f749e543 100644
--- a/pkgs/data/icons/kora-icon-theme/default.nix
+++ b/pkgs/data/icons/kora-icon-theme/default.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec  {
   pname = "kora-icon-theme";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub  {
     owner = "bikass";
     repo = "kora";
     rev = "v${version}";
-    sha256 = "sha256-YKdqV41HlQMvkyWoWbOCMUASshnEDnXtxzdmJdTEQGw=";
+    sha256 = "sha256-cWfQiJeyH/bkvASoe2nl4efHQdMpYFh587d5yycs31k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/vte/default.nix b/pkgs/development/libraries/vte/default.nix
index d5194ea299498..89af6e847a887 100644
--- a/pkgs/development/libraries/vte/default.nix
+++ b/pkgs/development/libraries/vte/default.nix
@@ -98,7 +98,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # error: argument unused during compilation: '-pie' [-Werror,-Wunused-command-line-argument]
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isMusl "-Wno-unused-command-line-argument";
+  env.NIX_CFLAGS_COMPILE = toString (lib.optional stdenv.hostPlatform.isMusl "-Wno-unused-command-line-argument"
+    ++ lib.optional stdenv.cc.isClang "-Wno-cast-function-type-strict");
 
   postPatch = ''
     patchShebangs perf/*
diff --git a/pkgs/development/misc/brev-cli/default.nix b/pkgs/development/misc/brev-cli/default.nix
index 146d41321c6a6..812f063a3c620 100644
--- a/pkgs/development/misc/brev-cli/default.nix
+++ b/pkgs/development/misc/brev-cli/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "brev-cli";
-  version = "0.6.279";
+  version = "0.6.284";
 
   src = fetchFromGitHub {
     owner = "brevdev";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-jQkaMFTArXPSCm6aBQb/vb4JEkgHtmzJl/Iz/f/pBSY=";
+    sha256 = "sha256-G70309GQ3C7ZBS4baRKN3Ms4MBvCmLmPorbByZy4Qh4=";
   };
 
   vendorHash = "sha256-IR/tgqh8rS4uN5jSOcopCutbHCKHSU9icUfRhOgu4t8=";
diff --git a/pkgs/development/python-modules/adext/default.nix b/pkgs/development/python-modules/adext/default.nix
index c5a05d19bee85..8a7345613de79 100644
--- a/pkgs/development/python-modules/adext/default.nix
+++ b/pkgs/development/python-modules/adext/default.nix
@@ -1,40 +1,39 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, setuptools-scm
-, alarmdecoder
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools-scm,
+  alarmdecoder,
+  pytestCheckHook,
+  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "adext";
-  version = "0.4.2";
-  format = "setuptools";
+  version = "0.4.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ajschmidt8";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0h5k9kzms2f0r48pdhsgv8pimk0vsxw8vs0k6880mank8ij914wr";
+    repo = "adext";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-y8BvcSc3vD0FEWiyzW2Oh6PBS2Itjs2sz+9Dzh5yqSg=";
   };
 
-  nativeBuildInputs = [
-    setuptools-scm
-  ];
+  build-system = [ setuptools-scm ];
 
-  propagatedBuildInputs = [
-    alarmdecoder
-  ];
+  dependencies = [ alarmdecoder ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "adext" ];
 
   meta = with lib; {
     description = "Python extension for AlarmDecoder";
     homepage = "https://github.com/ajschmidt8/adext";
+    changelog = "https://github.com/ajschmidt8/adext/releases/tag/v${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 8b7dcea1f3525..b29ddeedad7fe 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -1,38 +1,37 @@
-{ lib
-, babel
-, buildPythonPackage
-, click
-, cryptography
-, fetchPypi
-, gntp
-, installShellFiles
-, markdown
-, paho-mqtt
-, pytest-mock
-, pytest-xdist
-, pytestCheckHook
-, pythonOlder
-, pyyaml
-, requests
-, requests-oauthlib
-, setuptools
+{
+  lib,
+  babel,
+  buildPythonPackage,
+  click,
+  cryptography,
+  fetchPypi,
+  gntp,
+  installShellFiles,
+  markdown,
+  paho-mqtt,
+  pytest-mock,
+  pytest-xdist,
+  pytestCheckHook,
+  pythonOlder,
+  pyyaml,
+  requests,
+  requests-oauthlib,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "apprise";
-  version = "1.7.6";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-B38JMJzIpskGPb1hSzQ4B9Un1UZpO3/o/FpEM1Av6mw=";
+    hash = "sha256-6PWM6/6ho09WnLTGiAmjF1voDsBvCi7Ec1IrkgIyEsU=";
   };
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
 
   build-system = [
     babel
@@ -70,9 +69,7 @@ buildPythonPackage rec {
     installManPage packaging/man/apprise.1
   '';
 
-  pythonImportsCheck = [
-    "apprise"
-  ];
+  pythonImportsCheck = [ "apprise" ];
 
   meta = with lib; {
     description = "Push Notifications that work with just about every platform";
diff --git a/pkgs/development/python-modules/btrfs/default.nix b/pkgs/development/python-modules/btrfs/default.nix
index a534257c6dbef..66a7a05676a96 100644
--- a/pkgs/development/python-modules/btrfs/default.nix
+++ b/pkgs/development/python-modules/btrfs/default.nix
@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "btrfs";
-  version = "13";
+  version = "14.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-NSyzhpHYDkunuU104XnbVCcVRNDoVBz4KuJRrE7WMO0=";
+    hash = "sha256-BPKPwT33i8fQYJkUZbnJ8nQNbmKw0Dq6ekb9mr7awEY=";
   };
 
   # no tests (in v12)
diff --git a/pkgs/development/python-modules/cloudflare/default.nix b/pkgs/development/python-modules/cloudflare/default.nix
index f7bba7ba76ec7..34ca3c05bdcd3 100644
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "cloudflare";
-  version = "2.19.4";
+  version = "2.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O2AAoBojfCO8z99tICVupREex0qCaunnT58OW7WyOD8=";
+    hash = "sha256-Rq78Od+qI2XWObQjzsLNU1CuERU8ckfT6zVFvc8Bpoo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/courlan/default.nix b/pkgs/development/python-modules/courlan/default.nix
index bd73aad1977d8..fd2cfc01b6e8d 100644
--- a/pkgs/development/python-modules/courlan/default.nix
+++ b/pkgs/development/python-modules/courlan/default.nix
@@ -1,56 +1,58 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, langcodes
-, pytestCheckHook
-, tld
-, urllib3
-, pythonOlder
+{
+  lib,
+  babel,
+  buildPythonPackage,
+  fetchPypi,
+  langcodes,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  tld,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "courlan";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.1.0";
+  pyproject = true;
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PDVRHDZSXLL5Qc1nCbejp0LtlfC55WyX7sDBb9wDUYM=";
+    hash = "sha256-1wZoQzTxi+StofvVfyaArfADZkj22ECFL3pIItOt/Y0=";
   };
 
-  propagatedBuildInputs = [
+  # Tests try to write to /tmp directly. use $TMPDIR instead.
+  postPatch = ''
+    substituteInPlace tests/unit_tests.py \
+      --replace-fail "\"courlan --help\"" "\"$out/bin/courlan --help\"" \
+      --replace-fail "courlan_bin = \"courlan\"" "courlan_bin = \"$out/bin/courlan\"" \
+      --replace-fail "/tmp" "$TMPDIR"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    babel
     langcodes
     tld
     urllib3
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   # disable tests that require an internet connection
-  disabledTests = [
-    "test_urlcheck"
-  ];
-
-  # tests try to write to /tmp directly. use $TMPDIR instead.
-  postPatch = ''
-    substituteInPlace tests/unit_tests.py \
-      --replace "\"courlan --help\"" "\"$out/bin/courlan --help\"" \
-      --replace "courlan_bin = \"courlan\"" "courlan_bin = \"$out/bin/courlan\"" \
-      --replace "/tmp" "$TMPDIR"
-  '';
+  disabledTests = [ "test_urlcheck" ];
 
   pythonImportsCheck = [ "courlan" ];
 
   meta = with lib; {
     description = "Clean, filter and sample URLs to optimize data collection";
-    mainProgram = "courlan";
     homepage = "https://github.com/adbar/courlan";
     changelog = "https://github.com/adbar/courlan/blob/v${version}/HISTORY.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ jokatzke ];
+    mainProgram = "courlan";
   };
 }
diff --git a/pkgs/development/python-modules/dropbox/default.nix b/pkgs/development/python-modules/dropbox/default.nix
index 762b9b7ff8cf2..b090f81da9757 100644
--- a/pkgs/development/python-modules/dropbox/default.nix
+++ b/pkgs/development/python-modules/dropbox/default.nix
@@ -2,8 +2,8 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, requests
 , setuptools
+, requests
 , six
 , stone
 , mock
@@ -15,9 +15,10 @@
 buildPythonPackage rec {
   pname = "dropbox";
   version = "11.36.2";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
+
   outputs = ["out" "doc"];
 
   src = fetchFromGitHub {
@@ -27,9 +28,12 @@ buildPythonPackage rec {
     hash = "sha256-d++lxsbwPxnz1JPguWkImHXB+GQpMa9Uo3JNIxIe2ok=";
   };
 
-  propagatedBuildInputs = [
-    requests
+  build-system = [
     setuptools
+  ];
+
+  dependencies = [
+    requests
     six
     stone
   ];
diff --git a/pkgs/development/python-modules/hawkauthlib/default.nix b/pkgs/development/python-modules/hawkauthlib/default.nix
index 9df850b788297..b7c6c73820a25 100644
--- a/pkgs/development/python-modules/hawkauthlib/default.nix
+++ b/pkgs/development/python-modules/hawkauthlib/default.nix
@@ -1,28 +1,45 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, requests
-, webob
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  requests,
+  webob,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "hawkauthlib";
   version = "0.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mozilla-services";
-    repo = pname;
+    repo = "hawkauthlib";
     rev = "refs/tags/v${version}";
-    sha256 = "0mr1mpx4j9q7sch9arwfvpysnpf2p7ijy7072wilxm8pnj0bwvsi";
+    hash = "sha256-UW++gLQX1U4jFwccL+O5wl2r/d2OZ5Ug0wcnSfqtIVc=";
   };
 
-  propagatedBuildInputs = [ requests webob ];
+  postPatch = ''
+    substituteInPlace hawkauthlib/tests/* \
+        --replace-warn 'assertEquals' 'assertEqual'
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+    webob
+  ];
+
+  pythonImportsCheck = [ "hawkauthlib" ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
 
   meta = with lib; {
     homepage = "https://github.com/mozilla-services/hawkauthlib";
     description = "Hawk Access Authentication protocol";
     license = licenses.mpl20;
+    maintainers = with maintainers; [ ];
   };
-
 }
diff --git a/pkgs/development/python-modules/html-text/default.nix b/pkgs/development/python-modules/html-text/default.nix
index 00d2fb426d381..43d7ca228bb0e 100644
--- a/pkgs/development/python-modules/html-text/default.nix
+++ b/pkgs/development/python-modules/html-text/default.nix
@@ -1,37 +1,43 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, lxml
-, six
-, pytestCheckHook
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  lxml,
+  lxml-html-clean,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "html-text";
-  version = "0.5.2";
-  format = "setuptools";
+  version = "0.6.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
-    owner = "TeamHG-Memex";
+    owner = "zytedata";
     repo = "html-text";
-    rev = version;
-    hash = "sha256-jw/hpz0QfcgP5OEJcmre0h1OzOfpPtaROxHm+YUqces=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-e9gkibQv8mn1Jbt77UmpauOeTqhJQhY9R5Sge/iYi+U=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     lxml
+    lxml-html-clean
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    six
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "html_text" ];
 
   meta = with lib; {
     description = "Extract text from HTML";
-    homepage = "https://github.com/TeamHG-Memex/html-text";
+    homepage = "https://github.com/zytedata/html-text";
+    changelog = "https://github.com/zytedata/html-text/blob/${version}/CHANGES.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ambroisie ];
   };
diff --git a/pkgs/development/python-modules/htseq/default.nix b/pkgs/development/python-modules/htseq/default.nix
index 9d69a8bfef542..caa47f5197d60 100644
--- a/pkgs/development/python-modules/htseq/default.nix
+++ b/pkgs/development/python-modules/htseq/default.nix
@@ -1,29 +1,79 @@
-{ lib, buildPythonPackage, fetchFromGitHub, cython, numpy, pysam, matplotlib, python, isPy27, isPy3k }:
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchpatch,
+  swig,
+  cython,
+  matplotlib,
+  numpy,
+  pandas,
+  pysam,
+  setuptools,
+  pytestCheckHook,
+  nix-update-script,
+}:
 buildPythonPackage rec {
-  version = "0.12.4";
-  format = "setuptools";
   pname = "htseq";
+  version = "2.0.4";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "htseq";
     repo = "htseq";
     rev = "release_${version}";
-    sha256 = "0y7vh249sljqjnv81060w4xkdx6f1y5zdqkh38yk926x6v9riijm";
+    hash = "sha256-7ocrmuj9LOtPz9XbI5rKGcdE5JbFz/pZh00Nie65XxE=";
   };
 
-  nativeBuildInputs = [ cython ];
-  propagatedBuildInputs = [ numpy pysam matplotlib ];
+  patches = [
+    # https://github.com/htseq/htseq/pull/84
+    (fetchpatch {
+      name = "replace-distutils-with-sysconfig.patch";
+      url = "https://github.com/htseq/htseq/commit/f0f1e464ee9aee56f0b44f905e7b3355b0bb8f29.patch";
+      hash = "sha256-yDYkXCPy+YFgnk1rnXwCB998aZwVd5nJeejZIgeEzAo=";
+     })
+  ];
 
-  checkPhase = lib.optionalString isPy27 ''
-    ${python.interpreter} python2/test/test_general.py
-  '' + lib.optionalString isPy3k ''
-    ${python.interpreter} python3/test/test_general.py
+  nativeBuildInputs = [ swig ];
+
+  build-system = [
+    cython
+    numpy
+    pysam
+    setuptools
+  ];
+
+  dependencies = [
+    numpy
+    pysam
+  ];
+
+  optional-dependencies = {
+    htseq-qa = [ matplotlib ];
+  };
+
+  pythonImportsCheck = [ "HTSeq" ];
+
+  nativeCheckInputs = [
+    pandas
+    pytestCheckHook
+  ] ++ optional-dependencies.htseq-qa;
+
+  preCheck = ''
+    rm -r src HTSeq
+    export PATH=$out/bin:$PATH
   '';
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "release_(.+)"
+    ];
+  };
+
   meta = with lib; {
     homepage = "https://htseq.readthedocs.io/";
     description = "A framework to work with high-throughput sequencing data";
     maintainers = with maintainers; [ unode ];
-    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/python-modules/ical/default.nix b/pkgs/development/python-modules/ical/default.nix
index 7807d5d7b2798..826b2cee22356 100644
--- a/pkgs/development/python-modules/ical/default.nix
+++ b/pkgs/development/python-modules/ical/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "ical";
-  version = "8.0.0";
+  version = "8.0.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "allenporter";
     repo = "ical";
     rev = "refs/tags/${version}";
-    hash = "sha256-nwF6iInQzHdOtmcC1fi6CS2LnYRCxc/DS9bg8IxTlFg=";
+    hash = "sha256-GA2Kn6OednhQtNzmIq5npN2qXVaMHCzy02Jwx7g3GBA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pipdeptree/default.nix b/pkgs/development/python-modules/pipdeptree/default.nix
index 8dad1316c1a7f..b312b78a2bfb2 100644
--- a/pkgs/development/python-modules/pipdeptree/default.nix
+++ b/pkgs/development/python-modules/pipdeptree/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pipdeptree";
-  version = "2.19.1";
+  version = "2.20.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tox-dev";
     repo = "pipdeptree";
     rev = "refs/tags/${version}";
-    hash = "sha256-kXRz78UHQtVyHFFnURSjOOXX8Me2I5tG2bX+u2yGyzY=";
+    hash = "sha256-Mng5YUM2+T3OFrr4uGVvq5mP0aq10r21pp46tw6lLno=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/private-gpt/default.nix b/pkgs/development/python-modules/private-gpt/default.nix
new file mode 100644
index 0000000000000..226489d046cb4
--- /dev/null
+++ b/pkgs/development/python-modules/private-gpt/default.nix
@@ -0,0 +1,119 @@
+{ lib
+, buildPythonPackage
+, python
+, fetchFromGitHub
+, poetry-core
+, fastapi
+, injector
+, llama-index-core
+, llama-index-readers-file
+, huggingface-hub
+, python-multipart
+, pyyaml
+, transformers
+, uvicorn
+, watchdog
+, gradio
+, fetchurl
+, fetchpatch
+}:
+
+buildPythonPackage rec {
+  pname = "private-gpt";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "zylon-ai";
+    repo = "private-gpt";
+    rev = "v${version}";
+    hash = "sha256-bjydzJhOJjmbflcJbuMyNsmby7HtNPFW3MY2Tw12cHw=";
+  };
+
+  patches = [
+    # Fix a vulnerability, to be removed in the next bump version
+    # See https://github.com/zylon-ai/private-gpt/pull/1890
+    (fetchpatch {
+      url = "https://github.com/zylon-ai/private-gpt/commit/86368c61760c9cee5d977131d23ad2a3e063cbe9.patch";
+      hash = "sha256-4ysRUuNaHW4bmNzg4fn++89b430LP6AzYDoX2HplVH0=";
+    })
+  ];
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    fastapi
+    injector
+    llama-index-core
+    llama-index-readers-file
+    python-multipart
+    pyyaml
+    transformers
+    uvicorn
+    watchdog
+  ] ++ lib.flatten (builtins.attrValues passthru.optional-dependencies);
+
+  # This is needed for running the tests and the service in offline mode,
+  # See related issue at https://github.com/zylon-ai/private-gpt/issues/1870
+  passthru.cl100k_base.tiktoken = fetchurl {
+    url = "https://openaipublic.blob.core.windows.net/encodings/cl100k_base.tiktoken";
+    hash = "sha256-Ijkht27pm96ZW3/3OFE+7xAPtR0YyTWXoRO8/+hlsqc=";
+  };
+
+  passthru.optional-dependencies = with python.pkgs; {
+    embeddings-huggingface = [
+      huggingface-hub
+      llama-index-embeddings-huggingface
+    ];
+    embeddings-ollama = [
+      llama-index-embeddings-ollama
+    ];
+    embeddings-openai = [
+      llama-index-embeddings-openai
+    ];
+    embeddings-sagemaker = [
+      boto3
+    ];
+    llms-ollama = [
+      llama-index-llms-ollama
+    ];
+    llms-openai = [
+      llama-index-llms-openai
+    ];
+    llms-openai-like = [
+      llama-index-llms-openai-like
+    ];
+    llms-sagemaker = [
+      boto3
+    ];
+    ui = [
+      gradio
+    ];
+    vector-stores-chroma = [
+      llama-index-vector-stores-chroma
+    ];
+    vector-stores-postgres = [
+      llama-index-vector-stores-postgres
+    ];
+    vector-stores-qdrant = [
+      llama-index-vector-stores-qdrant
+    ];
+  };
+
+  postInstall = ''
+    cp settings*.yaml $out/${python.sitePackages}/private_gpt/
+  '';
+
+  pythonImportsCheck = [ "private_gpt" ];
+
+  meta = {
+    changelog = "https://github.com/zylon-ai/private-gpt/blob/${src.rev}/CHANGELOG.md";
+    description = "Interact with your documents using the power of GPT, 100% privately, no data leaks";
+    homepage = "https://github.com/zylon-ai/private-gpt";
+    license = lib.licenses.asl20;
+    mainProgram = "private-gpt";
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/python-modules/pybrowserid/default.nix b/pkgs/development/python-modules/pybrowserid/default.nix
index 1a4cd7c43058c..10346ee04cc3d 100644
--- a/pkgs/development/python-modules/pybrowserid/default.nix
+++ b/pkgs/development/python-modules/pybrowserid/default.nix
@@ -1,24 +1,44 @@
-{ lib, buildPythonPackage, fetchPypi
-, requests, mock }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  requests,
+  unittestCheckHook,
+  mock,
+}:
 
 buildPythonPackage rec {
   pname = "pybrowserid";
   version = "0.14.0";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "PyBrowserID";
     inherit version;
-    sha256 = "1qvi79kfb8x9kxkm5lw2mp42hm82cpps1xknmsb5ghkwx1lpc8kc";
+    hash = "sha256-bCJ2aeh8wleWrnb2oO9lAlUoyK2C01Jnn6mj5WY6ceM=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  postPatch = ''
+    substituteInPlace browserid/tests/* \
+        --replace-warn 'assertEquals' 'assertEqual'
+  '';
 
-  nativeCheckInputs = [ mock ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  pythonImportsCheck = [ "browserid" ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+    mock
+  ];
 
   meta = with lib; {
     description = "Python library for the BrowserID Protocol";
-    homepage    = "https://github.com/mozilla/PyBrowserID";
-    license     = licenses.mpl20;
+    homepage = "https://github.com/mozilla/PyBrowserID";
+    license = licenses.mpl20;
     maintainers = with maintainers; [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pyfxa/default.nix b/pkgs/development/python-modules/pyfxa/default.nix
index 39794d592103c..259370299db2e 100644
--- a/pkgs/development/python-modules/pyfxa/default.nix
+++ b/pkgs/development/python-modules/pyfxa/default.nix
@@ -18,7 +18,7 @@
 buildPythonPackage rec {
   pname = "pyfxa";
   version = "0.7.8";
-  format = "setuptools";
+  pyproject = true;
 
   disabled = pythonOlder "3.7";
 
@@ -28,7 +28,11 @@ buildPythonPackage rec {
     hash = "sha256-DMFZl1hbYNaScOTWkAbK2nKti6wD5SS5A30q7TW5vO4=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     cryptography
     hawkauthlib
     pybrowserid
diff --git a/pkgs/development/python-modules/pyinsteon/default.nix b/pkgs/development/python-modules/pyinsteon/default.nix
index 22242ee62bf49..0f52f3dbf45ce 100644
--- a/pkgs/development/python-modules/pyinsteon/default.nix
+++ b/pkgs/development/python-modules/pyinsteon/default.nix
@@ -1,23 +1,24 @@
-{ lib
-, aiofiles
-, aiohttp
-, async-timeout
-, async-generator
-, buildPythonPackage
-, fetchFromGitHub
-, pypubsub
-, pyserial
-, pyserial-asyncio
-, pytestCheckHook
-, pythonAtLeast
-, pythonOlder
-, setuptools
-, voluptuous
+{
+  lib,
+  aiofiles,
+  aiohttp,
+  async-timeout,
+  async-generator,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pypubsub,
+  pyserial,
+  pyserial-asyncio,
+  pytestCheckHook,
+  pythonAtLeast,
+  pythonOlder,
+  setuptools,
+  voluptuous,
 }:
 
 buildPythonPackage rec {
   pname = "pyinsteon";
-  version = "1.5.3";
+  version = "1.6.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,12 +27,10 @@ buildPythonPackage rec {
     owner = "pyinsteon";
     repo = "pyinsteon";
     rev = "refs/tags/${version}";
-    hash = "sha256-9d6QbekUv63sjKdK+ZogYOkGfFXVW+JB6ITHnehLwtM=";
+    hash = "sha256-s8YRDu+UpU1sisdscd87CpcLl3csOUDdIuKqx48GZsw=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiofiles
@@ -48,14 +47,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # RuntimeError: BUG: Dead Listener called, still subscribed!
+    "test_linking_with_i1_device"
+  ];
+
   disabledTestPaths = lib.optionals (pythonAtLeast "3.12") [
     # Tests are blocking or failing
     "tests/test_handlers/"
   ];
 
-  pythonImportsCheck = [
-    "pyinsteon"
-  ];
+  pythonImportsCheck = [ "pyinsteon" ];
 
   meta = with lib; {
     description = "Python library to support Insteon home automation projects";
diff --git a/pkgs/development/python-modules/pynmeagps/default.nix b/pkgs/development/python-modules/pynmeagps/default.nix
index 7791bb13f315e..89bfe09c1637b 100644
--- a/pkgs/development/python-modules/pynmeagps/default.nix
+++ b/pkgs/development/python-modules/pynmeagps/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pynmeagps";
-  version = "1.0.35";
+  version = "1.0.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "semuconsulting";
     repo = "pynmeagps";
-    rev = "v${version}";
-    hash = "sha256-ULGBfTHCFGUSF3cmJ4GEUrgGDo4uJwstBj8nZ7tj0AA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n7dCr85TeBLxdrD1ZAA7PGJd9+3+xFJ8gjRU/JOFysY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 31e730a0b9432..7d746131636e1 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "python-roborock";
-  version = "2.2.0";
+  version = "2.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "humbertogontijo";
     repo = "python-roborock";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/j7aJ34W7KP+O5ugl+xrA/X42SIjc+zfiBeSd1/4YZI=";
+    hash = "sha256-qyaERNaisfDWXW1IeyFMOV6nLqT+0O9QJ4U02LOyiuE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/sacn/default.nix b/pkgs/development/python-modules/sacn/default.nix
index 609d8969be6bc..f03c7a263271c 100644
--- a/pkgs/development/python-modules/sacn/default.nix
+++ b/pkgs/development/python-modules/sacn/default.nix
@@ -6,14 +6,14 @@
 
 buildPythonPackage rec {
   pname = "sacn";
-  version = "1.9.0";
+  version = "1.9.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-LimA0I8y1tdjFk244iWvKJj0Rx3OEaYOSIJtirRHh4o=";
+    hash = "sha256-ppXWRBZVm4QroxZ19S388sRuI5zpaDgJrJqhnwefr3k=";
   };
 
   # no tests
diff --git a/pkgs/development/python-modules/sarif-tools/default.nix b/pkgs/development/python-modules/sarif-tools/default.nix
new file mode 100644
index 0000000000000..785c26e345291
--- /dev/null
+++ b/pkgs/development/python-modules/sarif-tools/default.nix
@@ -0,0 +1,69 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, poetry-core
+, jsonpath-ng
+, jinja2
+, python
+, python-docx
+, matplotlib
+, pyyaml
+, pytestCheckHook
+, pythonOlder
+, pythonRelaxDepsHook
+}:
+
+buildPythonPackage rec {
+  pname = "sarif-tools";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "sarif-tools";
+    rev = "v${version}";
+    hash = "sha256-80amYGnf7xZdpxzTjBGwgg39YN/jJsEkTm0uAlVbH0w=";
+  };
+
+  disabled = pythonOlder "3.8";
+
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  propagatedBuildInputs = [
+    jsonpath-ng
+    jinja2
+    python
+    python-docx
+    matplotlib
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonRelaxDeps = [
+    "python-docx"
+  ];
+
+  disabledTests = [
+    # Broken, re-enable once https://github.com/microsoft/sarif-tools/pull/41 is merged
+    "test_version"
+  ];
+
+  pythonImportsCheck = [
+    "sarif"
+  ];
+
+  meta = {
+    description = "A set of command line tools and Python library for working with SARIF files";
+    homepage = "https://github.com/microsoft/sarif-tools";
+    changelog = "https://github.com/microsoft/sarif-tools/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ puzzlewolf ];
+    mainProgram = "sarif";
+  };
+}
diff --git a/pkgs/development/python-modules/trafilatura/default.nix b/pkgs/development/python-modules/trafilatura/default.nix
index 35212c3434438..a8183bf3f8411 100644
--- a/pkgs/development/python-modules/trafilatura/default.nix
+++ b/pkgs/development/python-modules/trafilatura/default.nix
@@ -1,35 +1,43 @@
-{ lib
-, buildPythonPackage
-, fetchPypi
-, pytestCheckHook
-, pythonOlder
-, certifi
-, charset-normalizer
-, courlan
-, htmldate
-, justext
-, lxml
-, urllib3
-, setuptools
+{
+  lib,
+  buildPythonPackage,
+  certifi,
+  charset-normalizer,
+  courlan,
+  fetchPypi,
+  htmldate,
+  justext,
+  lxml,
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+  urllib3,
 }:
 
 buildPythonPackage rec {
   pname = "trafilatura";
-  version = "1.8.1";
+  version = "1.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-a4eN/b1cXftV0Pgwfyt9wVrDRYBU90hh/5ihcvXjhyA=";
+    hash = "sha256-5oM9KauKE+2FOTfXyR5oaLxi774QIUrCsQZDbdI9FBI=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-  ];
+  # Patch out gui cli because it is not supported in this packaging and
+  # nixify path to the trafilatura binary in the test suite
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail '"trafilatura_gui=trafilatura.gui:main",' ""
+    substituteInPlace tests/cli_tests.py \
+      --replace-fail "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
+  '';
+
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     charset-normalizer
     courlan
@@ -39,34 +47,22 @@ buildPythonPackage rec {
     urllib3
   ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-  ];
+  nativeCheckInputs = [ pytestCheckHook ];
 
   disabledTests = [
     # Disable tests that require an internet connection
+    "test_cli_pipeline"
+    "test_crawl_page"
     "test_download"
     "test_fetch"
-    "test_redirection"
     "test_meta_redirections"
-    "test_crawl_page"
-    "test_whole"
     "test_probing"
-    "test_cli_pipeline"
+    "test_queue"
+    "test_redirection"
+    "test_whole"
   ];
 
-  # patch out gui cli because it is not supported in this packaging
-  # nixify path to the trafilatura binary in the test suite
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail '"trafilatura_gui=trafilatura.gui:main",' ""
-    substituteInPlace tests/cli_tests.py \
-      --replace-fail "trafilatura_bin = 'trafilatura'" "trafilatura_bin = '$out/bin/trafilatura'"
-  '';
-
-  pythonImportsCheck = [
-    "trafilatura"
-  ];
+  pythonImportsCheck = [ "trafilatura" ];
 
   meta = with lib; {
     description = "Python package and command-line tool designed to gather text on the Web";
diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index a8021045119a0..342a2c19e41df 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.58.0";
+  version = "1.58.1";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-qG/H6/FePQFJdiSnf1zh5Pos9KjuicRJ3HzDM0QXPSE=";
+    hash = "sha256-RnrD1KA0XNdFx5bs2vfCoBEuBjtesyyTXAvIWMeRPVQ=";
   };
 
-  vendorHash = "sha256-bT8MUeLk7LgLlqk3aBqsVU139ZH4y1ZFsQ67Lxj4OBg=";
+  vendorHash = "sha256-Q3y4yam9gRFopZbAlLzWSFj59j+WwWeflJMdYmmJh7U=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/development/tools/misc/terramate/default.nix b/pkgs/development/tools/misc/terramate/default.nix
index b6efe2732dcac..880183c8bdf60 100644
--- a/pkgs/development/tools/misc/terramate/default.nix
+++ b/pkgs/development/tools/misc/terramate/default.nix
@@ -6,22 +6,25 @@
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.4.2";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-aOKUC1FtDDhdUbPUSLW6GrSwh6r29Y2ObC6y487W4Zc=";
+    hash = "sha256-jcmOS81iPzy1ul0Cj/SiJk84AUIq7mLI+CmspuPit+o=";
   };
 
-  vendorHash = "sha256-gl5xsaSkGXlh+MfieVBPHGAbYZVF3GBbIkmvVhlJvqw=";
+  vendorHash = "sha256-Na2XDPSwgwWTQrweslAtSOh2+B/ZFaPIdy8ssAFWkGs=";
 
   # required for version info
   nativeBuildInputs = [ git ];
 
   ldflags = [ "-extldflags" "-static" ];
 
+  # Disable failing E2E tests preventing the package from building
+  excludedPackages = [ "./cmd/terramate/e2etests/cloud" "./cmd/terramate/e2etests/core" ];
+
   meta = with lib; {
     description = "Adds code generation, stacks, orchestration, change detection, data sharing and more to Terraform";
     homepage = "https://github.com/terramate-io/terramate";
diff --git a/pkgs/development/tools/rust/cargo-binstall/default.nix b/pkgs/development/tools/rust/cargo-binstall/default.nix
index b537a8056cf31..3c7421f841019 100644
--- a/pkgs/development/tools/rust/cargo-binstall/default.nix
+++ b/pkgs/development/tools/rust/cargo-binstall/default.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-binstall";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "cargo-bins";
     repo = "cargo-binstall";
     rev = "v${version}";
-    hash = "sha256-DD9tecF6oZOg501DUMm5KEPC2BOxMa78YGIXLvhsRys=";
+    hash = "sha256-o31/cEkQyn89URqmJpOZHG6YII8VOle1X3vwdgJF334=";
   };
 
-  cargoHash = "sha256-veVE4THR58DAOo0CqMCnN3EqCOEge8K0PvLM0KgHDnI=";
+  cargoHash = "sha256-kZZ2S3XDdCREuit3RIByLXn/tEiqY+Oap242ZXx6y6s=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/tools/yq-go/default.nix b/pkgs/development/tools/yq-go/default.nix
index f4d8137c33eba..f54f77113e42e 100644
--- a/pkgs/development/tools/yq-go/default.nix
+++ b/pkgs/development/tools/yq-go/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.43.1";
+  version = "4.44.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    hash = "sha256-AQOHVuDREp6OpwlPFwpCUOQACOsDRH0uM6WwKyEK4JI=";
+    hash = "sha256-5l948J0NTeWOeUMlcoEQZws8viqtARdkJsGch4c6Trw=";
   };
 
-  vendorHash = "sha256-9GCqZS0fguJo8GkVPMgbstEVzrjIS0kdbNQEaT1HSFI=";
+  vendorHash = "sha256-j5vcx5wW2v1kNc2QCPR11JEb1fTA9q4E4mbJ2VJC37A=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/servers/monitoring/prometheus/snmp-exporter.nix b/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
index 812484fdf615c..2f8c4f7ba3711 100644
--- a/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/snmp-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "snmp_exporter";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "prometheus";
     repo = "snmp_exporter";
     rev = "v${version}";
-    sha256 = "sha256-6Y2zJwY5gToJlY6iLug2jNXXtNLNz98WoTKGcWgYzaA=";
+    sha256 = "sha256-6UTvzcN0BB4uLfyZxr8CkmlMAjggYRV/EmQPRD7ZqmY=";
   };
 
-  vendorHash = "sha256-8soLDI/hBzSZB6Lfj1jVkIWfIkMPJmp84bu7TKg7jeo=";
+  vendorHash = "sha256-0WGiVM4HTgcVkCxfjW1c+z1wlf/ay5BXZXuGRPS4guc=";
 
   buildInputs = [ net-snmp ];
 
diff --git a/pkgs/servers/web-apps/netbox/default.nix b/pkgs/servers/web-apps/netbox/default.nix
index b47ab2cd350b7..1459ee23920c4 100644
--- a/pkgs/servers/web-apps/netbox/default.nix
+++ b/pkgs/servers/web-apps/netbox/default.nix
@@ -22,8 +22,8 @@ lib.fix (self: {
   };
 
   netbox_3_7 = callPackage generic {
-    version = "3.7.4";
-    hash = "sha256-jQJYtu1K13AsFXx4GTgtMOdppK1Tgoaf2/fKKhS1sQo=";
+    version = "3.7.8";
+    hash = "sha256-61pJbMWXNFnvWI0z9yWvsutdCAP4VydeceANNw0nKsk=";
     extraPatches = [
       # Allow setting the STATIC_ROOT from within the configuration and setting a custom redis URL
       ./config.patch
diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index a34e1285e3071..66a71c1fa3be6 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -1,6 +1,7 @@
 { egl-wayland
 , libepoxy
 , fetchurl
+, fetchpatch
 , fontutil
 , lib
 , libei
@@ -53,6 +54,17 @@ stdenv.mkDerivation rec {
     hash = "sha256-HJo2a058ytug+b0xPFnq4S0jvXJUOyKibq+LIINc/G0=";
   };
 
+  patches = [
+    # Backport fix for libei scrolling
+    # Notably affects Steam Input, but also anything else using xtest
+    # FIXME: remove when merged
+    # Upstream PR: https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1531
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/317712eb5a1aa4a1c3d737a8fcaee57add9981c9.patch";
+      hash = "sha256-TZo38Pyr9IJUF+3bqlmF4M84XGgo9G6WFTvbaP9r0XU=";
+    })
+  ];
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/tools/admin/google-cloud-sdk/default.nix b/pkgs/tools/admin/google-cloud-sdk/default.nix
index b8e49b37a8d2f..03078392264da 100644
--- a/pkgs/tools/admin/google-cloud-sdk/default.nix
+++ b/pkgs/tools/admin/google-cloud-sdk/default.nix
@@ -13,7 +13,7 @@ let
   pythonEnv = python.withPackages (p: with p; [
     cffi
     cryptography
-    openssl
+    pyopenssl
     crcmod
     numpy
   ] ++ lib.optional (with-gce) google-compute-engine);
diff --git a/pkgs/tools/misc/octosql/default.nix b/pkgs/tools/misc/octosql/default.nix
index a42f80d95ff95..675375cb09411 100644
--- a/pkgs/tools/misc/octosql/default.nix
+++ b/pkgs/tools/misc/octosql/default.nix
@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "octosql";
-  version = "0.12.2";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner  = "cube2222";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "sha256-jf40w5QkSTAgGu0JA4NeqsasN2TUf9vnKVw5zlZr8Mw=";
+    sha256 = "sha256-kzbIts5d2KmFfaAnOdpIXI1fiqBYXe5t981g4Uyk/cc=";
   };
 
   vendorHash = "sha256-p/2UsvxxywQKtk/9wDa5fjS0z6xLLzDONuQ5AtnUonk=";
diff --git a/pkgs/tools/misc/pre-commit/default.nix b/pkgs/tools/misc/pre-commit/default.nix
index 535ce1a8c4da4..122226486bd4b 100644
--- a/pkgs/tools/misc/pre-commit/default.nix
+++ b/pkgs/tools/misc/pre-commit/default.nix
@@ -18,7 +18,7 @@
 with python3Packages;
 buildPythonApplication rec {
   pname = "pre-commit";
-  version = "3.7.0";
+  version = "3.7.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -27,7 +27,7 @@ buildPythonApplication rec {
     owner = "pre-commit";
     repo = "pre-commit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-k9pC/GCtqLlK9PhZmx4EKWT1HDyl+KQubDFDQOZdKUQ=";
+    hash = "sha256-+9NNXM4i6saxktF1pl93dmkrqjsErqMB6kEK3IPQTNQ=";
   };
 
   patches = [
diff --git a/pkgs/tools/networking/shadowsocks-rust/default.nix b/pkgs/tools/networking/shadowsocks-rust/default.nix
index 3cf9c598b4ac7..360639fa9ad4f 100644
--- a/pkgs/tools/networking/shadowsocks-rust/default.nix
+++ b/pkgs/tools/networking/shadowsocks-rust/default.nix
@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "shadowsocks-rust";
-  version = "1.18.3";
+  version = "1.18.4";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "shadowsocks";
     repo = pname;
-    hash = "sha256-eqN6Qwq+ofQ9Ed7Viz+DoJQkVTvUTo1U5rVqO1YDp2w=";
+    hash = "sha256-1gZP0PVvYWEfWmTVql+8uyNhcjawBMJKvqy/4sZ0/6Y=";
   };
 
-  cargoHash = "sha256-yJ2Ql6Fo2KaZRmvRB0C14fEcVwbBbsUlcqT3vFKHn58=";
+  cargoHash = "sha256-GZuRz4VtAm+aQO0Hq5v3HVfqjoMPsEw5G6VADsAvdEQ=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];
 
diff --git a/pkgs/tools/package-management/lix/common.nix b/pkgs/tools/package-management/lix/common.nix
new file mode 100644
index 0000000000000..a544707b4f355
--- /dev/null
+++ b/pkgs/tools/package-management/lix/common.nix
@@ -0,0 +1,286 @@
+{
+  lib,
+  fetchFromGitHub,
+  version,
+  suffix ? "",
+  hash ? null,
+  src ? fetchFromGitHub {
+    owner = "lix-project";
+    repo = "lix";
+    rev = version;
+    inherit hash;
+  },
+  docCargoHash ? null,
+  patches ? [ ],
+  maintainers ? lib.teams.lix.members,
+}@args:
+assert (hash == null) -> (src != null);
+{
+  stdenv,
+  meson,
+  bash,
+  bison,
+  boehmgc,
+  boost,
+  brotli,
+  busybox-sandbox-shell,
+  bzip2,
+  callPackage,
+  coreutils,
+  curl,
+  cmake,
+  docbook_xsl_ns,
+  docbook5,
+  doxygen,
+  editline,
+  flex,
+  git,
+  gnutar,
+  gtest,
+  gzip,
+  jq,
+  lib,
+  libarchive,
+  libcpuid,
+  libgit2,
+  libsodium,
+  libxml2,
+  libxslt,
+  lowdown,
+  lsof,
+  man,
+  mercurial,
+  mdbook,
+  mdbook-linkcheck,
+  nlohmann_json,
+  ninja,
+  openssl,
+  toml11,
+  python3,
+  perl,
+  pkg-config,
+  rapidcheck,
+  Security,
+  sqlite,
+  util-linuxMinimal,
+  xz,
+  nixosTests,
+
+  enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
+  enableStatic ? stdenv.hostPlatform.isStatic,
+  withAWS ? !enableStatic && (stdenv.isLinux || stdenv.isDarwin),
+  aws-sdk-cpp,
+  # RISC-V support in progress https://github.com/seccomp/libseccomp/pull/50
+  withLibseccomp ? lib.meta.availableOn stdenv.hostPlatform libseccomp,
+  libseccomp,
+
+  confDir,
+  stateDir,
+  storeDir,
+}:
+let
+  lix-doc = callPackage ./doc {
+    inherit src;
+    version = "${version}${suffix}";
+    cargoHash = docCargoHash;
+  };
+  self = stdenv.mkDerivation {
+    pname = "lix";
+
+    version = "${version}${suffix}";
+    VERSION_SUFFIX = suffix;
+
+    inherit src patches;
+
+    outputs =
+      [
+        "out"
+        "dev"
+      ]
+      ++ lib.optionals enableDocumentation [
+        "man"
+        "doc"
+      ];
+
+    strictDeps = true;
+
+    nativeBuildInputs =
+      [
+        pkg-config
+        bison
+        flex
+        jq
+        meson
+        ninja
+        cmake
+        python3
+        doxygen
+
+        # Tests
+        git
+        mercurial
+        jq
+        lsof
+      ]
+      ++ lib.optionals (enableDocumentation) [
+        (lib.getBin lowdown)
+        mdbook
+        mdbook-linkcheck
+      ]
+      ++ lib.optionals stdenv.isLinux [ util-linuxMinimal ];
+
+    buildInputs =
+      [
+        boost
+        brotli
+        bzip2
+        curl
+        editline
+        libsodium
+        openssl
+        sqlite
+        xz
+        gtest
+        libarchive
+        lowdown
+        rapidcheck
+        toml11
+        lix-doc
+      ]
+      ++ lib.optionals stdenv.isDarwin [ Security ]
+      ++ lib.optionals (stdenv.isx86_64) [ libcpuid ]
+      ++ lib.optionals withLibseccomp [ libseccomp ]
+      ++ lib.optionals withAWS [ aws-sdk-cpp ];
+
+    propagatedBuildInputs = [
+      boehmgc
+      nlohmann_json
+    ];
+
+    postPatch = ''
+      patchShebangs --build tests
+    '';
+
+    preConfigure =
+      # Copy libboost_context so we don't get all of Boost in our closure.
+      # https://github.com/NixOS/nixpkgs/issues/45462
+      lib.optionalString (!enableStatic) ''
+        mkdir -p $out/lib
+        cp -pd ${boost}/lib/{libboost_context*,libboost_thread*,libboost_system*} $out/lib
+        rm -f $out/lib/*.a
+        ${lib.optionalString stdenv.isLinux ''
+          chmod u+w $out/lib/*.so.*
+          patchelf --set-rpath $out/lib:${stdenv.cc.cc.lib}/lib $out/lib/libboost_thread.so.*
+        ''}
+        ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+          for LIB in $out/lib/*.dylib; do
+            chmod u+w $LIB
+            install_name_tool -id $LIB $LIB
+            install_name_tool -delete_rpath ${boost}/lib/ $LIB || true
+          done
+          install_name_tool -change ${boost}/lib/libboost_system.dylib $out/lib/libboost_system.dylib $out/lib/libboost_thread.dylib
+        ''}
+      '';
+
+    mesonFlags =
+      [
+        (lib.mesonEnable "gc" true)
+        (lib.mesonBool "enable-tests" true)
+        (lib.mesonBool "enable-docs" enableDocumentation)
+        (lib.mesonBool "enable-embedded-sandbox-shell" (stdenv.isLinux && stdenv.hostPlatform.isStatic))
+        (lib.mesonEnable "seccomp-sandboxing" withLibseccomp)
+
+        (lib.mesonOption "store-dir" storeDir)
+        (lib.mesonOption "state-dir" stateDir)
+        (lib.mesonOption "sysconfdir" confDir)
+      ]
+      ++ lib.optionals stdenv.isLinux [
+        (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
+      ];
+
+    # Needed for Meson to find Boost.
+    # https://github.com/NixOS/nixpkgs/issues/86131.
+    env = {
+      BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
+      BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
+    };
+
+    postInstall =
+      ''
+        mkdir -p $doc/nix-support
+        echo "doc manual $doc/share/doc/nix/manual" >> $doc/nix-support/hydra-build-products
+      ''
+      + lib.optionalString stdenv.hostPlatform.isStatic ''
+        mkdir -p $out/nix-support
+        echo "file binary-dist $out/bin/nix" >> $out/nix-support/hydra-build-products
+      ''
+      + lib.optionalString stdenv.isDarwin ''
+        for lib in libnixutil.dylib libnixexpr.dylib; do
+          install_name_tool \
+            -change "${lib.getLib boost}/lib/libboost_context.dylib" \
+            "$out/lib/libboost_context.dylib" \
+            "$out/lib/$lib"
+        done
+      '';
+
+    doCheck = true;
+    mesonCheckFlags = [ "--suite=check" ];
+    checkInputs = [
+      gtest
+      rapidcheck
+    ];
+
+    doInstallCheck = true;
+    mesonInstallCheckFlags = [ "--suite=installcheck" ];
+
+    preInstallCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # socket path becomes too long otherwise
+      export TMPDIR=$NIX_BUILD_TOP
+      # Prevent crashes in libcurl due to invoking Objective-C `+initialize` methods after `fork`.
+      # See http://sealiesoftware.com/blog/archive/2017/6/5/Objective-C_and_fork_in_macOS_1013.html.
+      export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES
+    '';
+
+    installCheckPhase = ''
+      runHook preInstallCheck
+      flagsArray=($mesonInstallCheckFlags "''${mesonInstallCheckFlagsArray[@]}")
+      meson test --no-rebuild "''${flagsArray[@]}"
+      runHook postInstallCheck
+    '';
+    # strictoverflow is disabled because we trap on signed overflow instead
+    hardeningDisable = [ "strictoverflow" ] ++ lib.optional stdenv.hostPlatform.isStatic "pie";
+    # hardeningEnable = lib.optionals (!stdenv.isDarwin) [ "pie" ];
+    # hardeningDisable = lib.optional stdenv.hostPlatform.isMusl "fortify";
+    separateDebugInfo = stdenv.isLinux && !enableStatic;
+    enableParallelBuilding = true;
+
+    passthru = {
+      inherit aws-sdk-cpp boehmgc;
+      tests = {
+        misc = nixosTests.misc.lix.passthru.override { nixPackage = self; };
+      };
+    };
+
+    # point 'nix edit' and ofborg at the file that defines the attribute,
+    # not this common file.
+    pos = builtins.unsafeGetAttrPos "version" args;
+    meta = with lib; {
+      description = "Powerful package manager that makes package management reliable and reproducible";
+      longDescription = ''
+        Lix (a fork of Nix) is a powerful package manager for Linux and other Unix systems that
+        makes package management reliable and reproducible. It provides atomic
+        upgrades and rollbacks, side-by-side installation of multiple versions of
+        a package, multi-user package management and easy setup of build
+        environments.
+      '';
+      homepage = "https://lix.systems";
+      license = licenses.lgpl21Plus;
+      inherit maintainers;
+      platforms = platforms.unix;
+      outputsToInstall = [ "out" ] ++ optional enableDocumentation "man";
+      mainProgram = "nix";
+      broken = enableStatic;
+    };
+  };
+in
+self
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
new file mode 100644
index 0000000000000..9a03e64f8b8fc
--- /dev/null
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  aws-sdk-cpp,
+  boehmgc,
+  callPackage,
+  fetchFromGitHub,
+  Security,
+
+  storeDir ? "/nix/store",
+  stateDir ? "/nix/var",
+  confDir ? "/etc",
+}:
+let
+  boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; };
+
+  boehmgc-nix = boehmgc-nix_2_3.overrideAttrs (drv: {
+    patches = (drv.patches or [ ]) ++ [
+      # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
+      ../nix/patches/boehmgc-coroutine-sp-fallback.patch
+    ];
+  });
+
+  aws-sdk-cpp-nix =
+    (aws-sdk-cpp.override {
+      apis = [
+        "s3"
+        "transfer"
+      ];
+      customMemoryManagement = false;
+    }).overrideAttrs
+      {
+        # only a stripped down version is build which takes a lot less resources to build
+        requiredSystemFeatures = [ ];
+      };
+
+  common =
+    args:
+    callPackage (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) {
+      inherit
+        Security
+        storeDir
+        stateDir
+        confDir
+        ;
+      boehmgc = boehmgc-nix;
+      aws-sdk-cpp = aws-sdk-cpp-nix;
+    };
+in
+lib.makeExtensible (self: ({
+  lix_2_90 = (
+    common {
+      version = "2.90-beta.1";
+      hash = "sha256-REWlo2RYHfJkxnmZTEJu3Cd/2VM+wjjpPy7Xi4BdDTQ=";
+      docCargoHash = "sha256-oH248kR4Of0MhcY2DYxNX0A+/XJ3L+UuIpBKn3sJt54=";
+    }
+  );
+
+  latest = self.lix_2_90;
+  stable = self.lix_2_90;
+}))
diff --git a/pkgs/tools/package-management/lix/doc/default.nix b/pkgs/tools/package-management/lix/doc/default.nix
new file mode 100644
index 0000000000000..a3c1d7d9ccc5a
--- /dev/null
+++ b/pkgs/tools/package-management/lix/doc/default.nix
@@ -0,0 +1,12 @@
+{
+  src,
+  rustPlatform,
+  version,
+  cargoHash,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "lix-doc";
+  sourceRoot = "${src.name}/lix-doc";
+  inherit version src cargoHash;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0f17cd91bebd1..61573dc54057b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -39587,6 +39587,16 @@ with pkgs;
 
   nixStatic = pkgsStatic.nix;
 
+  lixVersions = recurseIntoAttrs (callPackage ../tools/package-management/lix {
+    storeDir = config.nix.storeDir or "/nix/store";
+    stateDir = config.nix.stateDir or "/nix/var";
+    inherit (darwin.apple_sdk.frameworks) Security;
+  });
+
+  lix = lixVersions.stable;
+
+  lixStatic = pkgsStatic.lix;
+
   inherit (callPackages ../applications/networking/cluster/nixops { })
     nixops_unstable_minimal
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 180c167c1f82d..23ae40ca934d5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9891,6 +9891,8 @@ self: super: with self; {
 
   ppdeep = callPackage ../development/python-modules/ppdeep { };
 
+  private-gpt = callPackage ../development/python-modules/private-gpt { };
+
   prodict = callPackage ../development/python-modules/prodict { };
 
   prometheus-pandas = callPackage ../development/python-modules/prometheus-pandas { };
@@ -13566,6 +13568,8 @@ self: super: with self; {
 
   sarif-om = callPackage ../development/python-modules/sarif-om { };
 
+  sarif-tools = callPackage ../development/python-modules/sarif-tools { };
+
   sarge = callPackage ../development/python-modules/sarge { };
 
   sasmodels = callPackage ../development/python-modules/sasmodels { };